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Executive  Summary 


On  18  March  2013,  the  chief  of  staff  of  the  Air  Force  tasked  the  Air 
Force  Research  Institute  (AFRI)  to  review  the  training  and  develop¬ 
ment  of  the  USAF  cyber  forces  to  take  stock  of  current  Air  Force  cy¬ 
ber  force  development.  AFRI  was  to  determine  whether  structural 
changes  were  required  to  ensure  the  successful  organizing,  training, 
and  equipping  of  the  Air  Force’s  cyber  workforce.  This  study  is  the 
culmination  of  research  AFRI  conducted  to  examine  the  USAF’s  cy¬ 
ber  human  capital  planning  and  management  strategies  and  to  rec¬ 
ommend  improvements  where  needed. 

The  goal  of  this  study  was  to  examine  how  we  should  recruit,  edu¬ 
cate,  train,  and  develop  cyber  operators  from  the  time  they  are  poten¬ 
tial  accessions  until  they  become  senior  leaders  in  the  enlisted  and 
officer  corps.  Guiding  the  research  were  these  key  questions: 

•  What  is  a  “cyber  force”? 

•  What  must  the  Air  Force  do  to  organize,  train,  and  equip  Air¬ 
men  who  can  plan  and  execute  Air  Force  and  joint  missions  in 
cyberspace? 

•  What  force  structure  is  needed  to  operate  the  Air  Force’s  defined 
mission  sets? 

•  Should  the  Air  Force  cyber  force  remain  a  traditional  force  or  be 
modeled  on  a  nontraditional  personnel  structure? 

To  explore  facets  of  cyber  workforce  development,  the  research 
team  collaborated  with  six  directorates  of  Headquarters  Air  Force 
and  the  Twenty-Fourth  Air  Force,  Twenty-Fifth  Air  Force  (then  the 
Air  Force  Intelligence,  Surveillance,  and  Reconnaissance  Agency 
[AFISRA]),  Air  Force  Space  Command  (AFSPC),  Air  Force  Person¬ 
nel  Center  (AFPC),  Air  Education  and  Training  Command  (AETC), 
National  Security  Agency  (NSA),  Central  Intelligence  Agency  (CIA), 
Air  Force  Research  Laboratory  (AFRL),  Air  Force  Wargaming  Center 
(AFWC),  Air  Force  Institute  of  Technology  (AFIT),  United  States 
Cyber  Command  (USCYBERCOM),  US  Navy,  US  Army,  US  Marine 
Corps,  and  many  other  organizations  across  the  government,  the  pri¬ 
vate  sector,  academia,  and  civil  society.  The  intent  was  to  create  a  set 
of  recommendations  not  only  to  meet  Air  Force  mission  require¬ 
ments  but  also  to  fit  the  manpower  demand  of  USCYBERCOM’s  Cyber 
Mission  Force,  currently  in  the  process  of  expanding. 
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The  study  surveyed  technological  trends  that  will  affect  the  work¬ 
force.  Cyber — a  dynamic  domain  of  warfare — will  change.  Personnel 
planners  must  not  focus  solely  on  accessing  operators  with  knowl¬ 
edge,  skills,  and  abilities  (KSA)  to  harness  todays  technology  but  also 
must  consider  future  technologies  when  they  forecast  manpower  re¬ 
quirements.  Otherwise,  we  may  be  investing  in  skill  sets  needed  in 
today’s  computing  environment  but  perhaps  not  in  the  midterm  as 
trends  such  as  cloud  computing  begin  more  widespread  adoption 
worldwide  and  the  inevitable  transition  to  Internet  Protocol  version 
6  (IPv6)  commences  in  earnest. 

Our  summary  of  conclusions  for  senior  leaders  is  broken  out  along 
the  lines  of  the  organize,  train,  and  equip  construct. 

Organize 

Recruiting.  The  research  team  found  that  discovering  people  with 
an  aptitude  for  cyber  operations  is  essential — a  majority  of  recruits 
should  be  deeply  experienced  in  the  fields  of  science,  technology,  en¬ 
gineering,  and  mathematics  (STEM).  However,  we  are  concerned 
that  placing  too  high  a  value  on  STEM  degrees  may  create  barriers  to 
entry  in  the  cyber  field,  thereby  excluding  some  very  talented  opera¬ 
tors  and  depleting  the  pool  from  which  operators  are  drawn.  In  addi¬ 
tion,  we  concluded  that  the  USAF  needs  cyber  operators  with  not 
only  a  proclivity  toward  cyber  operations  but  also  a  grasp  of  legal, 
policy,  and  ethical  issues  related  to  cyber  operations  and  national  se¬ 
curity.  However,  this  cadre  is  shallow  and  needs  to  be  grown.  We 
therefore  urge  the  addition  of  “arts”  to  STEM — creating  “STEAM.” 
STEAM  will  assure  that  the  USAF  has  a  team  of  social/behavioral 
scientists,  lawyers,  and  instructors  who  have  a  sound  understanding 
of  the  technology  but  specialize  in  crafting  policy.  These  team  mem¬ 
bers  will  work  alongside  their  STEM  counterparts  to  integrate  cyber 
power  in  service  to  the  nation. 

Proper  accessions  will  require  more  targeted  recruiting  and  train¬ 
ing.  Models  predicting  cyber  success  are  useful  in  selecting  people  for 
cyber  training  and  reducing  washout  rates.  We  recommend  (1)  con¬ 
tinued  utilization  of  a  cyber  test  to  identify  high-potential  recruits — 
both  within  the  service  and  from  the  general  US  population — with 
an  aptitude  for  cyber  and  a  grasp  of  basic  principles  of  information 
technology,  (2)  ongoing  investment  in  screening,  and  (3)  consideration 
of  adjusting  the  test  to  include  variables  that  can  discover  innovative, 
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autodidactic  team  players  who  do  not  limit  themselves  to  the  tactics, 
techniques,  and  procedures  (TTP)  checklists. 

This  study  confirmed  that  hacker  stereotypes  are  often  inaccurate. 
Many  hackers  we  interviewed  did  not  align  with  the  caricature  of 
couch  potatoes  living  in  their  parents’  basement;  they  included  mara¬ 
thon  runners  and  patriotic  citizens  with  outside-the-box  ways  of 
critically  analyzing  problem  sets  but  who  felt  disinclined  to  enter 
government  service.  Therefore,  senior  leaders  who  perpetuate  a  stereo¬ 
type  of  hackers  as  “a  certain  kind  of  individual”  do  a  disservice  to  at¬ 
tracting  talent  into  the  military  and  government. 

Contributing  to  negative  perceptions  of  the  hacker  community  is 
the  tendency  to  focus  on  destructively  inclined  individuals,  thus 
tainting  how  inquisitive  hackers  are  viewed.  A  major  recruiting  chal¬ 
lenge  we  discovered  was  the  impact  of  criminal  records  on  the  ability 
to  obtain  security  clearances.  This  situation  is  partly  due  to  the  strict 
criminalization  of  hacking  activity  in  the  United  States,  including 
that  of  the  inquisitive  hacker  types  (discussed  later  in  this  study).  We 
found  that  the  USAF  would  benefit  from  leveraging  games  and  com¬ 
petitions  to  serve  as  an  outlet  for  inquisitive  hacking  skills  and  to  in¬ 
still  our  core  values  into  individuals  who  aspire  to  join  the  ranks  of 
those  defending  the  nation.  Legitimate  hacking  competitions  provide 
legal  outlets  for  students  with  creative  computer  skills.  From  these 
competitions  and  through  its  sponsorship  of  and  advertising  at  these 
competitions,  the  USAF  can  and  should  recruit  only  those  personnel 
who  clearly  adhere  to  its  core  values. 

We  also  found  that  not  all  officers  with  computer  science  (CS), 
computer  engineering  (CE),  or  electrical  engineering  (EE)  degrees 
enter  the  17-series  cyber  operator  career  field  once  they  join  the  Air 
Force.  Anecdotal  stories  of  people  who  have  a  proclivity  to  hack  but 
are  initially  assigned  outside  cyber  suggest  that  the  Air  Force  should 
identify  a  path  for  Airmen  to  transfer  into  the  17X/1B4/3D  series  or 
cyber- related  civilian  career  fields  later  in  their  careers.  The  cyber  test 
could  be  one  way  to  allow  Airmen  from  other  Air  Force  specialty 
codes  (AFSC)  who  are  interested  in  cyber — or  with  CS,  CE,  or  EE 
degrees — to  demonstrate  their  aptitude  to  be  cyber  warriors. 

We  found  that  any  reliance  on  Officer  Training  School  (OTS)  to 
produce  cyber  accessions  is  problematic.  A  statistical  analysis  of  OTS 
accessions  shows  that  when  the  US  economy  is  robust,  OTS  has  a 
greatly  diminished  capacity  to  recruit  or  access  cyber  officers.  Fur¬ 
thermore,  because  of  the  Air  Force’s  current  disinclination  to  direct 
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US  Air  Force  Academy  (USAFA)  cadets  to  certain  majors  and  career 
fields,  the  USAFA  cannot  be  counted  upon  to  deliver  more  cyber- 
educated  graduates.  Thus,  we  recommend  that  ROTC  be  the  primary 
accession  source  for  educated  cyber  warriors  and  that  ROTC  budgets 
be  bolstered  to  recruit  STEAM-qualified  17D-  and  17S-series  offi¬ 
cers.  We  also  recommend  targeted  recruiting  and  scholarships  at 
high-ranking  state  colleges  as  the  most  cost-efficient  methods  of  at¬ 
tracting  top  cyber  talent  for  the  lowest  tuition  expenditures. 

Retention.  The  study  also  focused  on  retaining  our  investment  in 
cyber  operators.  While  retention  is  generally  high  at  present,  there  is 
cause  for  long-term  concern.  The  Air  Force  is  seeking  to  recruit  and 
retain  skills  in  high  demand  in  industry.  Despite  this  trend,  research 
shows  that  statistically  the  Air  Force  has  very  high  retention  rates  for 
personnel  serving  on  national  mission-related  teams  because  those 
Airmen  have  extremely  high  job  satisfaction.  However,  the  quality 
of  those  individuals  who  departed — described  anecdotally  as  top 
performers — is  not  quantifiable.  At  the  juncture  where  an  Airman  is 
asked  to  leave  one  of  these  teams  for  instructor  or  field  duty,  retention 
is  a  problem;  we  heard  several  anecdotal  stories  of  senior  noncommis¬ 
sioned  officers  departing  the  service  within  two  years  of  retirement.  In 
most  cases,  they  were  hired  by  contractors  to  continue  doing  the  same 
job  they  were  doing  before,  often  at  higher  pay  and  without  having  to 
change  duty  locations.  To  retain  the  flexibility  to  reliably  move  Airmen 
as  needed,  we  recommend  that  the  Air  Force  explore  the  legalities  of 
including  noncompete  clauses  to  restrict  contractor  competition  for 
cyber  Airmen  who  have  not  yet  reached  retirement  age. 

We  further  recommend  that  the  USAF  examine  possible  paths  for 
regaining  individuals  who  separated  from  the  service  to  practice  cyber 
operations  in  the  private  sector  but  might  later  want  to  return  to  gov¬ 
ernment  work  to  apply  lessons  learned  in  industry  to  USAF  missions. 

Educate/Train 

The  Air  Force  accesses  an  officer  and  enlisted  corps  that  generally 
has  no  understanding  of  cyber  hygiene;  this  practice  threatens  the 
security  of  our  networks,  given  that  we  do  not  acquire  systems  with 
mission  assurance  designed  into  our  systems  and  platforms.  Con¬ 
trary  to  intuition,  most  of  our  new  Airmen  do  not  understand  why  or 
how  many  types  of  cyber  intrusions  happen.  They  cannot  compre¬ 
hend  how  to  recognize  even  the  more  commonly  found  types  of  mal- 
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ware  or  phishing.  The  core  of  this  problem  is  not  the  proverbial  “dumb 
users”  but  poor  system  design  and  engineering  rooted  in  how  the 
software  and  hardware  industries  create  their  products.  Fixing  this 
problem  at  the  core  requires  technological  solutions  by  implementing 
either  better  system  design  or  information  assurance  measures  to 
prevent  social  engineering  and  other  unintentional  insider  threats. 
To  ameliorate  this  situation,  we  recommend  that  the  Air  Force  establish 
a  short  course  in  cyber  hygiene  with  course  objectives  of  achieving 
analysis-level  understanding  of  common  cyber  threats  as  a  part  of  all 
officer  and  enlisted  accessions  programs.  We  stress,  however,  that  this 
is  a  short-  and  midterm  objective  as  the  cyber  acquisition  process 
evolves  and  as  cost-effective  strategies  for  “baking  in”  security  based  on 
mission  priorities  and  requirements  are  developed  and  implemented. 

The  USAF  needs  to  better  emphasize  cyber  education.  To  compete 
with  nation-state  adversaries,  the  Air  Force  and  Department  of  Defense 
(DOD)  at  large  require  a  cadre  of  operators  that  have  the  founda¬ 
tional  skills  of  mathematics  and  computer  programming  to  react  to 
novel  threats  in  novel  solutions.  A  significant  area  of  concern  that  we 
discovered  during  our  research  is  Air  Force  efforts  to  ramp  up  the 
cyber  workforce  with  trained  operators  who  are  commercially  certified 
rather  than  with  educated  officers  who  can  apply  their  knowledge  to 
address  unique  threats.  We  concluded  that  education  (learning  how 
to  think)  is  as  valuable,  or  more  so,  than  training  (learning  how  to 
do).  This  finding  leads  to  recommendations  to  expand  the  intake  of 
new  graduates  to  include  the  arts — or  the  STEAM  concept — and  em¬ 
phasize  the  AFRL/AFIT  advanced  cyber  engineering  and  cyber  edu¬ 
cation  programs  as  well  as  advanced  academic  degrees  (AAD). 

We  found  few  personnel  with  AADs  across  the  cyber  AFSCs.  The 
historic  difficulty  in  finding  AADs  for  cyber  billets  compelled  leaders 
to  remove  requirements  from  the  personnel  rosters  so  their  vacant 
billets  could  be  filled  by  AFPC.  Doing  so  leaves  a  dearth  of  education 
and  creative  thinking  in  our  cyber  forces.  We  therefore  recommend 
that  cyber  leaders  recode  billets  they  believe  should  have  an  AAD  as¬ 
signed  as  “AAD  required.”  AFPC  should  then  take  those  requirements 
and  create  a  glide  path  for  the  cyber  career  fields  to  grow  their  AAD 
population  to  meet  that  demand.  A  cyber  graduate  program  similar  to 
that  offered  by  the  School  of  Advanced  Air  and  Space  Studies  (SAASS), 
alongside  the  AFIT  cyber  operations  master’s  degree  program,  is  a 
logical  piece  of  the  solution  to  the  AAD  shortage.  Until  the  right  num¬ 
ber  of  AADs  is  created,  AFPC  should  still  fill  AAD-required  billets 
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with  the  best  people  available  so  as  to  not  penalize  commanders  for 
making  their  needs  known. 

A  gap  currently  exists  in  the  production  of  planners  and  strategists 
who  have  operational-  and  strategic-level  familiarity  with  the  cyber 
domain.  To  help  bridge  this  gap,  we  recommend  that  Air  University 
be  leveraged  to  gather  critical,  strategic  thinkers  from  across  the  gov¬ 
ernment  and  private  sector  to  advance  thought  in  our  newest  domain 
of  cyberspace.  We  also  recommend  that  the  USAF  establish  a  Center 
for  Advanced  Cyber  Thinking  and  Strategy  (C-ACTS)  at  Air  University 
to  promote  new  concepts  of  how  cyber  can  perform  or  enhance  the 
USAF  s  core  missions.  These  ideas  can  then  be  used  to  educate  plan¬ 
ners  and  strategists  through  the  existing  Cyber  Horizons  program. 

Related  to  the  above  recommendations,  our  study  noted  that  many 
people  within  the  Air  Force  perceive  cyber  as  a  new  domain  yet  ne¬ 
glect  our  services  nearly  30-year  history  of  operations  within  it.  Con¬ 
sequently,  Airmen  fail  to  understand  past  problems  and  lessons 
learned  that  could  be  harnessed  to  propel  our  cyber  policies  and  TTPs 
into  the  future.  We  recommend  that  the  Air  Force  Historical  Research 
Agency  be  commissioned  to  collect  official  cyber  unit  histories  and 
oral  histories  of  the  pioneers  of  the  Air  Force  cyber  mission  for  use  as 
the  basis  of  follow-on  studies  with  appropriate  lessons  learned. 

Because  cyber  workforce  development  is  a  whole-of-government 
problem,  the  president  has  directed  a  whole-of-government  educa¬ 
tional  solution  in  which  the  Air  Force  should  play  its  part.  Led  by  the 
Department  of  Homeland  Security  (DHS),  the  National  Initiative  for 
Cybersecurity  Education  (NICE)  will  standardize  both  cyber  func¬ 
tions  and  the  education  requirements  to  perform  those  functions 
across  the  entire  US  government  workforce.  We  recommend  that  the 
Air  Force  begin  to  align  the  key  KSAs  in  which  cyber  operators  are 
educated  and  trained  to  the  NICE  framework,  which,  as  of  this  writ¬ 
ing,  the  Office  of  Personnel  Management  is  scheduled  to  implement 
in  2018. 

Although  the  cyber  career  field  evolves  rapidly,  the  research  team 
found  that  the  cyber  curriculum  does  not  always  keep  pace.  System¬ 
atic  procedures  for  updating  curricula  add  rigor  to  the  USAF’s  educa¬ 
tion  and  training  programs  but  may  create  a  lag  time  before  courses 
reflect  real-world  capabilities.  Thus,  we  recommend  that  all  cyber- 
related  schools  be  tasked  with  keeping  their  curricula  fully  current  as 
changes  occur  in  cyberspace. 
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Equip 

Equipping  the  schoolhouse  and  training  ranges  is  one  area  that 
should  receive  priority  to  enhance  the  cyber  workforce.  Cyber-range 
facilities  in  which  to  practice  cyberspace  operations  are  presently  in¬ 
adequate.  Most  of  these  ranges  are  funded  out  of  hide  or  with  fallout 
money.  To  assist  in  keeping  curricula  up  to  date,  we  recommend  that 
this  haphazard  method  of  funding  cyberspace  training  and  education 
cease.  Specifically,  cyber  ranges  should  be  included  in  the  program 
objective  memorandum  (POM),  with  all  monies  and  personnel 
needed  for  operations  and  maintenance  explicitly  present  in  the  an¬ 
nual  budget  in  exactly  the  same  manner  we  create  a  POM  for  ranges 
in  the  other  two  domains  (air  and  space). 

Cyberspace  is  evolving  rapidly  in  terms  of  applications  and  threats. 
The  core  of  the  digital  network  environment,  however,  is  on  the  cusp 
of  changing  for  the  first  time  in  history  with  the  shift  from  IPv4  to 
IPv6.  The  Air  Force  has  a  tremendous  opportunity  and  responsibility 
to  lead  the  DOD  and  the  nation  in  the  transition  to  IPv6.  Such  a  shift 
will  help  reduce  existing  attack  vectors  into  US  systems  while  en¬ 
abling  the  Air  Force  to  better  accomplish  its  mission.  It  will  require 
the  service’s  cyber  operators  to  keep  pace  with  technological  change. 
The  Air  Force’s  cyber  schoolhouses  offer  some  general  background 
on  IPv6,  but  it  is  insufficient.  Detailed,  specific  training  on  IPv6 
should  be  required.  We  recommend  that  our  senior  leaders  make 
IPv6  migration  a  primary  focus  area  and  give  IPv6  education  and 
training  sufficient  commitment  to  spur  the  necessary  transition.  Har¬ 
nessing  IPv6  is  critical  if  the  Air  Force  is  to  remain  the  best- equipped, 
best-trained,  and  most  lethal  force  on  the  planet. 

Nonstandardized  equipment  and  inadequate  contractor  perfor¬ 
mance  have  facilitated  recent  adverse  cyber  events.  This  study  finds 
that  the  Air  Force  can  hold  vendors  financially  liable  for  inept  soft¬ 
ware  designs  and/or  coding  that  leave  systems  vulnerable.  The  re¬ 
search  team  concedes  that  efforts  are  under  way  to  pursue  such  ac¬ 
tion.  Any  revenue  arising  from  these  efforts  should  be  directed  to 
addressing  the  specific  problem  created  by  the  vendor  and  then  to 
enhancing  software  assurance  so  the  same  thing  does  not  happen 
again.  Finally,  since  fixing  poor  programming  can  be  more  difficult 
and  costly  than  writing  it  properly  in  the  first  place,  the  DOD  and  Air 
Force  should  provide  adequate  incentives  for  secure  programming 
that  far  exceeds  the  level  necessary  to  avoid  liability. 
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This  study’s  discoveries,  analyses,  and  recommendations  are  aimed 
at  guiding  staff  officers  and  senior  leaders  alike  as  they  consider  how 
to  create  a  cyber  workforce  that  better  supports  both  Air  Force  and 
US  Cyber  Command  missions  across  the  range  of  military  opera¬ 
tions.  Our  overarching  recommendations  are  summarized  in  table  1 . 
For  an  expanded  list  of  recommendations  and  their  statuses,  see  the 
appendix. 


Table  1.  Key  recommendations 


Key  Recommendations 

Organize 

Educate/Train 

Equip 

Use  economic  indica¬ 
tors  with  existing 
manning  and  retention 
statistics  to  adjust  se¬ 
lective  reenlist  bonuses 
to  mitigate  manning 
crisis  levels.  (AFPC) 

Examine/implement  reforms 
to  the  Instructional  Systems 
Development  process  with 
career  field  to  ensure  that 
education  and  training  are 
attuned  to  the  operational 
environment.  (AETC/AFPSC) 

Mandate  IPv6 
transition  for  the 
USAF's  operational 
benefit.  (HAF/A6/ 
AFNIC) 

Recognize  cyber  as  a 
separate  domain  with 
separate  language  / 
social  science  require¬ 
ments,  and  catalog 
personnel  identified/ 
recruited. 

Map  curriculum  to  NICE'S 
KSAs  to  ensure  interagency 
relevance.  Investigate  use 
of  cyber  competitions  for 
recruiting. 

Actively  contribute 
to  Internet  gover¬ 
nance.  (A6/AFRL/ 
AFIT) 

Incorporate  DHS-NICE 
framework  across  cyber 
career  fields.  (A6S) 

Enhance  the  IPv6  network¬ 
ing  and  software  program¬ 
ming  in  the  curriculum. 
(AFSPC/AETC) 

Equip  schools 
consistent  with 
POMed  (requested 
in  program  objec¬ 
tive  memorandum) 
lab/range  equip¬ 
ment,  including 
software/hardware. 

Create  electronic 
position  description/ 
tracking  mechanism 
mapped  to  NICE. 
Investigate  the  use  of 
the  special  experience 
identifier  (SEI)  to  track 

In  lean  years,  give  the  1  B4 
career  field  priority  for 
tuition  assistance  and  other 
like  programs  in  cyber- 
related  fields. 

Integrate  acquired 
systems  to  avoid  a 
"patchwork  quilt" 
of  systems  and 
software.  (AFSPC, 
SAF/AQ,  AFMC) 

specialized  cyber  skills 
for  assignments.  (AT ) 
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Table  1  ( continued ) 


Key  Recommendations 

Organize 

Educate/Train 

Equip 

Mandate  that  cyber 
units  code  their  billets 
for  AADs. 

Fully  fund  the  AFIT/AFRL 
distinct  ACE  programs 
(change  AFIT  program 
name);  estimated  cost  is 
$1.6M. 

Emphasize  soft¬ 
ware  assurance, 
and  incentivize 
contractors  to  use 
best  practices. 

USAFA  customers 
should  create  demand 
signal  to  cadets  that 
there  are  good  jobs  for 
them  as  1 7D/Ss.  Create 
a  summer  course  for 

Ramp  up  cyber  AAD  pro¬ 
duction  (including  AFIT)  to 
meet  identified  demand. 
Create  a  cyber  hygiene 
curriculum  for  accessions 
programs.  (AETC) 

Develop  technical 
cyber  acquisi¬ 
tion  certification 
similar  to  that  for 
engineering. 

cadets  as  a  means  of 
enticing  them  into  the 
career  field.  (USAFA) 


Notes 

(All  notes  appear  in  shortened  form.  For  full  details,  see  the  appropriate  entry  in 
the  bibliography.) 

1.  Yannakogeorgos,  “Rise  of  IPv6,”  103-28. 

2.  National  Defense  Authorization  Act  for  Fiscal  Year  2013,  Public  Law  1 12-239, 
sec.  933. 

3.  Dacus  and  Yannakogeorgos,  “Designing  Cybersecurity  into  Defense  Systems.” 
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Chapter  1 


Introduction:  Project  Context 
and  Methodology 

Tasking 

The  chief  of  staff  of  the  Air  Force  (CSAF)  charged  the  Air  Force  Re¬ 
search  Institute  (AFRI)  with  reviewing  and  recommending  actions  for 
the  development  of  USAF  cyberspace  forces  in  the  areas  of  education, 
training,  and  assignment  and  then  identifying  a  cybersecurity  human 
capital  planning  and  management  strategy  This  book  is  the  culmina¬ 
tion  of  our  findings.  The  appendix  provides  a  comprehensive  list  of 
near-term  recommended  tasks  and  the  offices  of  primary  responsibility. 

Definitions 

Before  delving  into  the  cyberspace  career  field,  the  research  team 
sought  to  clarify  the  terms  cyberspace  and  cyber  operations.  This  project 
was  more  a  personnel  than  a  cyber  study;  thus,  resolving  the  question 
of  what  cyberspace  is,  which  continues  to  vex  the  nation  and  world, 
was  beyond  its  scope.  The  team  therefore  used  the  Department  of 
Defense  (DOD)  definitions  of  cyber-related  terms  in  Joint  Publica¬ 
tion  (JP)  3-12  (R),  Cyberspace  Operations,  to  focus  the  study  (fig.  1). 

Cyberspace  Operations:  “The  employment  of  cyberspace  capabilities  where 
the  primary  purpose  is  to  achieve  objectives  in  or  through  cyberspace.” 

Offensive  Cyber  Operations  (OCO):  The  projection  of  power  “by  the  applica¬ 
tion  of  force  in  and  through  cyberspace”  to  deny  the  adversary  freedom  of  action. 

Defensive  Cyber  Operations  (DCO):  Ensuring  freedom  of  action  via  active/passive 
defense  to  “preserve  the  ability  to  utilize  friendly  cyberspace  capabilities  and 
protect  data,  networks,  net-centric  capabilities,”  etc. 

DOD  Information  Networks  (DODIN):  “Actions  taken  to  design,  build,  config¬ 
ure,  secure,  operate,  maintain,  and  sustain  DOD  communications  systems  and 
networks  in  a  way  that  creates  and  preserves  data  availability,  integrity,  [and] 
confidentiality.” 

Figure  1.  Cyber  operations  definitions.  (Developed  from  JP  3-12  (R), 
Cyberspace  Operations,  5  February  2013,  v,  vii,  11-2.) 
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The  research  team  also  utilized  the  CSAF’s  determinations  at  the 
June  2013  Corona  about  which  career  fields,  functions,  and  highly 
specialized  skills  comprise  USAF  cyberspace  operations.  Cyberspace 
career  fields  currently  fall  broadly  into  three  categories:  OCO,  DCO, 
and  cyberspace  infrastructure  maintenance — the  DODIN.  The  per¬ 
sonnel  required  to  conduct  operations  in  these  broad  categories  in¬ 
clude  the  enlisted  career  fields  1B4  (cyberspace  defensive  operations), 
1NX  (highly  specialized  cyberspace  intelligence  analyst),  and  3D  (cy¬ 
berspace  support);  the  officer  17  series  (cyberspace  warfare  and  net¬ 
work  operations)  and  14N  (intelligence)  career  fields;  and  a  myriad  of 
other  active  duty  and  civilian  occupational  codes.  To  reduce  the  com¬ 
plexity  of  the  study,  the  team  focused  on  career  fields  of  core  cyber¬ 
space  operators  who  will  serve  on  US  Cyber  Command  (USCYBER- 
COM)  cyber  teams. 


Tasks  and  Timelines 

Figure  2  depicts  the  tasks  and  timelines  of  each  research  phase: 


Figure  2.  Tasks  and  timelines  of  research  phases 

One  should  note  that  throughout  the  research  phase,  the  Air  Force 
was  making  continuous  progress  to  refine  how  it  organizes,  trains, 
and  equips  for  conflict  in  cyberspace.  As  the  research  team  interacted 
with  stakeholders  in  cyber  force  development  throughout  the  service, 
solutions  to  identified  problems  were  either  already  being  discussed 
or  spurred  by  the  research  team’s  insights  and  inquiries.  Additionally, 
as  researchers  identified  areas  that  needed  to  be  broadcast  to  a  wider 
audience,  they  published  results,  produced  working  papers,  and 
made  presentations  regarding  the  current  state  of  their  research  and 
received  feedback.1 
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Phases  1  and  2:  Defining  the  Problem,  Exploratory 
Research,  and  Analysis 


Hypothesis  Testing 

The  study’s  thesis  question  asked  whether  the  current  system  of 
accessing,  educating,  and  training  cyberspace  operators  to  prepare 
them  for  the  roles  and  missions  they  will  perform  for  combatant 
commanders  is  optimal.  The  study’s  hypothesis  asserts  that  this  sup¬ 
position  is  true.  The  tasking  letter,  however,  clearly  presumes  this  hy¬ 
pothesis  to  be  false  based  on  the  charge  to  develop  a  new  plan  for 
cyberspace  human  capital  management.  This  tasking  also  reflects  an 
Air  Force  senior  leadership  view  that  improvements  need  to  be  made 
in  accessing,  educating,  and  training  cyberspace  operators.  Prelimi¬ 
nary  interviews  supported  Air  Force  leadership  beliefs,  corroborating 
that  the  hypothesis  appeared  to  be  false.  Participating  organizations 
at  this  stage  were  Twenty-Fourth  Air  Force  (24th  AF),  Headquarters 
Air  Education  and  Training  Command  (AETC),  Headquarters  Air 
Force  Space  Command  (AFSPC),  Headquarters  Air  Force  A3/5  (HAF 
A3/5),  and  the  Air  Force  Secretariat  Office  of  Information  Domi¬ 
nance  and  Chief  Information  Officer  (SAF/CIO  A6). 

In  parallel  to  this  study,  the  entire  Air  Force  cyber  workforce  man¬ 
agement  enterprise  was  also  working  to  address  the  CSAF’s  con¬ 
cerns.  By  developing  a  collaborative  relationship  with  Air  Staff  mem¬ 
bers,  the  AFRI  research  team  assured  that  its  efforts  were  included. 
Further,  we  shared  discoveries  about  various  stovepipes  for  the  Air 
Staff’s  consideration  as  it  worked  tirelessly  to  implement  change  in 
the  cyber  workforce. 

To  fully  evaluate  the  thesis  question  and  substantiate  the  prelimi¬ 
nary  interviews,  the  team  designed  this  study  as  an  inductive  synthe¬ 
sis  of  the  Air  Force  and  national  cyberspace  enterprise.  This  approach 
allowed  the  research  team  to  develop  a  set  of  forward-looking  re¬ 
quirements  for  the  cyberspace  force  and  a  plan  that  meets  these  re¬ 
quirements.  The  plan  addresses  the  CSAF’s  concern  that  the  Air 
Force  has  become  the  “universal  donor”  of  cyberspace  personnel  to 
USCYBERCOM  and  others  within  the  national  cyberspace  enter¬ 
prise.  Therefore,  a  significant  consideration  in  this  study  was  the  level 
of  demand  for  cyberspace  operators — both  now  and  in  the  future — 
from  agencies  within  the  national  cyberspace  enterprise. 
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Bounding  the  Area  of  Study 

By  its  very  definition,  this  study  was  vast.  It  touched  on  every  as¬ 
pect  of  the  cyberspace  community  from  the  accessions  process  for 
junior  Airmen  and  lieutenants  to  the  development  of  our  most  senior 
generals.  Nonetheless,  the  research  team  established  boundaries  for 
the  study  so  that  “mission  creep”  would  not  create  an  unmanageable 
project.  Team  members  established  parameters  defining  the  bound¬ 
aries  of  each  of  the  key  and  contextual  questions  during  the  explor¬ 
atory  research  phase  of  the  project.  Setting  such  limits  helped  to 
avoid  wasting  resources  researching  irrelevant  areas;  however,  the 
parameters  were  relaxed  enough  to  allow  for  deeper  investigation  of 
crucial  aspects  of  the  cyber  workforce. 

The  AFRI  research  team  began  the  research  process  with  an  ex¬ 
pansive  scope  of  questions  pertaining  to  cyberspace  operator  force 
development,  with  the  goal  of  learning  more  about  individuals  in  cy¬ 
ber  operations  career  fields.  These  individuals  are  in  diverse  Air  Force 
units,  including  the  Air  Force  Personnel  Center  (AFPC),  AFSPC, 
Twenty-Fourth  Air  Force,  AETC,  and  HAF/A6SF.  Cyberspace  opera¬ 
tions  have  a  wide  spectrum  of  issues  across  numerous  disciplines.  For 
example,  cyberspace  force  development  not  only  must  include  cur¬ 
riculum  development  and  personnel  reform  but  also  must  consider 
the  environment  in  which  future  cyberspace  warriors  will  have  to 
operate.  This  environment  includes  the  technical  complexity  and 
rapidly  changing  aspects  of  the  domain,  the  threat  landscape,  actor 
motivations,  and  emerging  as  well  as  future  targets. 

Identifying  Key  Questions 

The  research  team  conducted  a 
series  of  group  discussions  to 
identify  what  questions  the  study 
would  examine.  The  sessions,  held 
by  the  research  team  at  the  outset 
of  phase  1,  were  helpful  in  recog¬ 
nizing  some  of  these  key  questions 
and  guiding  the  interview  process. 

To  further  refine  the  study  questions  that  guided  the  remaining  phases 
of  the  project,  team  members  held  discussions  with  key  stakeholders 
after  the  initial  key  questions  were  developed. 


Outputs  from  This  Activity 

•  Expert  relationships  developed 
through  outreach  and  interview 
processes;  ability  to  hold  follow-up 
discussions  with  experts 

•  General  understanding  of  the  key 
force  development  issues  through¬ 
out  interview  process 
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Broad  questions  that  guided  the  research  team  as  it  conducted  the 
study  were  key,  and  they  contained  subcomponents  or  subquestions 
requiring  analysis.  Where  possible,  each  subquestion  was  addressed 
by  at  least  two  methodological  approaches,  and,  when  appropriate, 
quantitative  analysis  and  statistical  modeling  provided  rigor  to  quali¬ 
tative  assessments. 

Identifying  Experts  and  Conducting  Structured  Interviews 

At  the  study’s  onset,  one  of  the  primary  goals  was  to  analyze  the 
issues  efficiently  and  thoroughly.  For  the  research  team,  this  step 
meant  traveling  to  relevant  sites  to  talk  with  key  cyber  workforce 
stakeholders.  The  organizational  complexity  of  the  study  made  in- 
person,  structured  interviews  essential.  Additionally,  such  interviews 
helped  the  research  team  build  working  relationships  with  key  stake¬ 
holders,  thereby  gaining  their  trust  and  confidence  so  they  would  be 
willing  to  share  the  information  required  by  the  research  team.2 

Structured  interviews  were  identified  as  an  appropriate  qualitative 
research  tool  to  enable  researchers  to  gain  insights  into  specific  areas 
where  information  was  limited  in  existing  literature.3  Other  than  Air 
Force  strategy  and  doctrine,  no  published  works  directly  addressed 
developing  the  USAF’s  human  capital  required  for  conducting  cyber¬ 
space  operations.  Thus,  in  this  study,  a  significant  portion  of  the  data 
on  cyberspace  operator  development  came  from  interviewing  in¬ 
formed  experts  because  their  thoughts  on  the  subject  were  not  in  any 
written  source. 

To  conduct  the  networking  and  structured  interview  process,  the 
research  team  took  the  following  steps.  First,  it  developed  a  struc¬ 
tured  interview  guide  during  a  brainstorming  session  during  which  a 
series  of  open-ended  and  direct  questions  about  the  study  were 
crafted  and  then  peer-reviewed  with  cyber  experts.  Researchers  used 
the  guide  to  prompt  interviewees  to  provide  meaningful  responses  to 
topics  of  interest,  including  their  general  understanding  of  cyber  is¬ 
sues  as  well  as  their  perspectives  of  specific  aspects  being  investigated. 
Asking  all  interviewees  the  same  series  of  questions  also  assured  con¬ 
sistency.  The  interview  guide  was  crafted  across  the  spectrum  of  ex¬ 
pertise,  including  the  military/ government,  the  intelligence  commu¬ 
nity,  academia,  the  private  sector,  and  hackers  to  avoid  asking  experts 
irrelevant  questions  about  areas  they  were  unfamiliar  with. 
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Once  the  team  identified  an  expert,  members  contacted  that  per¬ 
son  via  the  most  prudent  form  of  communication  (e.g.,  a  phone  call 
or  an  e-mail).  In  the  contact  process,  researchers  provided  an  over¬ 
view  of  the  project,  a  description  of  how  they  found  the  expert,  an 
explanation  about  why  the  researcher  thought  this  expert  could  pro¬ 
vide  relevant  information  to  help  the  project,  and,  finally,  a  copy  of 
the  interview  guide  to  allow  the  expert  to  begin  thinking  about  the 
questions  prior  to  the  appointment. 

The  research  team  started  the  structured  interview  process  with 
managers  and  experts  at  AFSPC,  Twenty-Fourth  Air  Force,  HAF/A6, 
and  AETC  to  quickly  learn  about  the  nature  of  problems  associated 
with  cyberspace  force  development.4  These  experts  were  helpful  in 
several  ways: 

1.  They  provided  information  that  helped  researchers  build  a  basic 
understanding  of  the  topic. 

2.  By  sharing  their  own  hypotheses  about  the  topic,  they  showed 
researchers  alternative  ways  of  looking  at  the  issue. 

3.  They  suggested  other  individuals,  organizations,  and  written 
sources  to  tap  for  additional  relevant  information  and  opinions. 

4.  Their  development  of  a  trust-based  relationship  with  the  re¬ 
search  team  early  in  the  research  process  led  to  increased  stake¬ 
holder  buy-in  throughout  the  study. 

AFRI  initiated  the  networking  process  by  identifying  personnel  in 
relevant  Air  Force  organizations  who  might  have  an  understanding 
of,  or  specific  knowledge  about,  force  development  issues  in  the  cyber¬ 
space  career  fields.  They  included  military  members  ranging  from 
enlisted  personnel  to  flag  officers,  DOD  civilians,  and  contractors 
from  AETC,  AFPC,  Twenty-Fourth  Air  Force,  and  AFSPC.  These  ex¬ 
changes  yielded  a  list  of  43  other  offices  to  be  included  in  the  study 
process  (not  including  offices  recommended  or  directed  by  the  CSAF 
and  other  general  officers).  Outside  the  Air  Force,  several  interagency 
partners  were  also  incorporated  into  the  study — such  as  the  Defense 
Information  Systems  Agency  (DISA),  Department  of  Homeland  Se¬ 
curity  (DHS),  National  Security  Agency  (NSA),  and  Central  Intelli¬ 
gence  Agency  (CIA) — to  help  guard  against  myopic  conclusions.  Ad¬ 
ditionally,  several  civilian  information  technology  (IT)  firms  and  the 
National  Academy  of  Science  were  consulted  to  provide  broader 
viewpoints  on  the  subject. 
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Researchers  found  the  interviews  with  informed  experts  extremely 
useful  to  the  study  since  they  provided  direct  answers  to  their  ques¬ 
tions.  During  these  interviews  and  discussions,  researchers  used  a 
structured  interview  guide  to  ask  experts  questions  tied  to  their  spe¬ 
cific  areas  of  expertise.  This  structured  interview  process  gave  the  re¬ 
search  team  relevant,  current  information  to  analyze  and  often  led  to 
specific  areas  requiring  further  research. 

The  team  ensured  thoroughness  in  the  interview  process  by  having 
one  cyber  subject-matter  expert  and  one  researcher  familiar  with  the 
Air  Force  personnel  system  present  for  each  interview.  The  research 
team  decided  to  conduct  the  interviews  in  this  manner  because  the 
study  was  both  technically  complex  and  highly  personnel-related  in 
nature.  Early  evidence  clearly  demonstrated  that  significant  data 
would  have  been  missed  without  the  perspectives  of  both  researchers 
during  the  interviews. 

Additionally,  the  interview  process  during  the  initial  phase  al¬ 
lowed  the  research  team  to  build  a  repository  of  individuals  who  were 
consulted  for  their  expertise  throughout  the  later  phases.  As  the  re¬ 
search  team  identified  various  issues  with  the  cyberspace  force,  it 
contacted  applicable  experts  in  its  contact  list.  Oftentimes,  the  Air 
Force  was  able  to  resolve  these  issues  relatively  quickly  either  through 
informing  the  researchers  of  ongoing  processes  or  commencing  pro¬ 
cesses  if  feasible.  The  relationships  that  the  team  developed  with  the 
network  of  experts  throughout  the  study  thus  allowed  it  to  iteratively 
refine  its  knowledge  of  specific  issues,  keep  the  contents  of  the  study 
current,  and  facilitate  connections  within  the  cyber  workforce  bu¬ 
reaucracy  to  help  the  Air  Force  resolve  career  field  issues. 

During  the  initial  phase, 
the  research  team  reviewed 
written  sources  to  find  cyber¬ 
space  experts  outside  the  realm 
of  normal  Air  Force  thinking. 

It  identified  a  number  of  in¬ 
teresting  thinkers  with  a  vari¬ 
ety  of  perspectives  and  initiated 
contact  with  them  in  hopes  of 
illuminating  ideas  and  per¬ 
spectives  that  challenge  cur¬ 
rent  assumptions  about  cy¬ 
berspace  force  development. 


Outputs  from  This  Activity 

•  List  of  key  sources  on  professional 
development  of  cyber  forces,  future 
threat  environments,  and  cyber  policy 

•  General  understanding  of  topic, 
developed  through  research  into  written 
sources  and  interviews/site  visits 

•  Input  and  buy-in  from  all  project 
stakeholders 

•  Set  of  key  questions  about  the  develop¬ 
ment  of  USAF  cyber  operators  that 
should  be  included  in  developing  the 
model 
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While  cyberspace  experts  form  a  relatively  tight-knit  community,  the 
research  team  discovered  that  they  are  generally  happy  to  share  their 
unique  information  and  experience.  Interviewees  from  this  commu¬ 
nity  discussed  with  researchers  specific  problems  they  would  like  ad¬ 
dressed  in  the  study  and  suggested  others  who  could  provide  relevant 
information  about  the  Air  Force’s  cyberspace  force  development  is¬ 
sues.  Thus,  this  study  was  not  limited  only  to  Air  Force  experts.  To 
gain  a  broader  understanding  of  a  subject,  researchers  engaged  with 
experts  outside  the  Air  Force — including  stakeholders  from  sister 
services,  interagency  partners,  the  private  sector,  hacker  communi¬ 
ties,  academia,  and  international  partners. 

Identifying  Sources  for  Exploratory  Research 

The  team  conducted  exploratory  research  concurrent  with  the  in¬ 
terview  process  and  development  of  the  network  of  experts.  Re¬ 
searchers  examined  doctrinal,  policy,  academic,  and  media  literature 
concerning  issues  related  to  developing  the  USAF’s  cyberspace  op¬ 
erators.  A  breadth  of  written  sources  was  surveyed  to  uncover  infor¬ 
mation  about  past  efforts,  current  practices,  and  anticipated  best 
practices  as  well  as  any  differing  opinions  among  key  authors  about 
the  issues  being  investigated.  This  data  helped  the  team  evaluate  its 
own  assumptions  and  biases  and  build  its  own  analysis  of  the  issue. 

The  research  team  consulted  a  wide  variety  of  resources  to  aug¬ 
ment  interviews  and  discussions  with  leaders  in  the  cyber  arena. 
These  included  Air  Force,  DOD,  and  intelligence  community  policy 
and  doctrine;  books  and  academic  journals;  newspaper  and  maga¬ 
zine  articles;  blogs  and  Internet  sites;  and  industry  reports.  Overall, 
this  exploratory  research  yielded  insights  along  a  curve  of  diminish¬ 
ing  returns.  Although  initial  research  returned  a  host  of  new  insights, 
team  members  found  fewer  novel  ideas  and  observations  as  their  re¬ 
search  continued.  They  determined  that  they  were  nearing  comple¬ 
tion  of  this  research  phase  when  findings  became  redundant  and  new 
avenues  stopped  appearing.  Organizations  visited  and  consulted  dur¬ 
ing  the  course  of  the  study  include  but  are  not  limited  to  those  found 
in  figure  3. 
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Air  Force 

Joint 

Private  Sector/Academia 

Air  Force  Space  Command 

US  Cyber  Command 

MITRE 

Twenty-fourth  Air  Force 

1 0th  Fleet 

CACI 

Air  Force  Intelligence,  Surveillance,  and 

Army  Cyber  Command 

RAND 

Reconnaissance  Agency 

Marine  Forces  Cyberspace  Command 

Harvard 

US  Air  Force  Academy 

Air  Force  Personnel  Center 

Defense  Information  Systems  Agency 

Massachusetts  Institute 
ofTechnology 

Air  Force  Research  Laboratory 

Interagency 

Allies 

Sensors  Directorate 

Central  Intelligence  Agency 

711th  Human  Performance  Wing 
Headquarters  Air  Force  (A1 , 2, 3, 5, 6, 9) 

Air  Force  Institute  of  Technology 

Air  Force  Weapons  School 

National  Security  Agency 

Department  of  Homeland  Security 
National  Institute  of  Standards  and 
Technology 

Baltic  Defense  College 

Goodfellow  AFB 

Air  Force  Office  of  Special  Investigations 
333d  Training  Squadron 
39th  Information  Operations  Squadron 
National  Air  and  Space  Intelligence  Center 
Business  and  Enterprise  Systems  Directorate 


Figure  3.  Organizations  visited  and  consulted 


Phase  3:  Analysis  and  Vetting  Findings  with 
OCRs  and  against  Data 

This  step  of  the  research  involved  vetting  preliminary  findings  and 
conclusions  on  the  key  questions  with  interested  agencies  and  stake¬ 
holders.5  The  purpose  of  this  process  was  to  ensure  peer  review  by 
outside  experts  and  to  uncover  stakeholder  sensitivities  or  other  issues 
of  importance  to  them. 
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Where  the  vetting  process  found  controversy  in  the  preliminary 
findings  or  recommendations,  those  areas  were  further  researched, 
revised  as  appropriate,  and  used  for  subsequent  vetting.  This  iterative 
process  was  similar  to  an  informal  Delphi  approach  that  allowed  the 
findings  to  improve  over  time  and  produce  a  quality,  peer-reviewed 
final  report.  In  some  cases,  this  process  uncovered  bureaucratic  sen¬ 
sitivities  not  related  to  errors  of  fact  in  the  analysis.  The  causes  of 
these  objections  were  recorded  alongside  the  rationale.  If  these  objec¬ 
tions  could  not  be  resolved  in  the  research  process,  they  are  noted  in 
this  book  and  were  disclosed  to  the  CSAF. 

A  Cyber  Advisory  Group  (CAG)  was  formed  to  vet  findings  and 
gather  data  during  the  conclusion  of  the  research  project.  This  group 
consisted  of  a  wide  range  of  experts  consulted  throughout  the  research 
process,  including  key  stakeholders,  operators,  policy  makers,  Air 
University  (AU)  faculty,  and  strategic  thinkers  across  the  Air  Force. 
One  goal  of  the  meeting  was  to  refine  our  final  analytical  product  by 
bringing  together  policy  makers  and  practitioners  with  whom  the  re¬ 
search  team  engaged  over  the  past  year  of  our  study  to  judge  the  fea¬ 
sibilities  of  our  proposed  recommended  solutions.  Another  aim  was 
to  specify  how  existing  responsibilities  or  authorities  should  be  mod¬ 
ified  to  improve  the  management  of  cyber  career  fields  within  the 
military  to  support  US  national  security  applications  of  cyber  power. 

The  event  gave  participants  an  opportunity  to  engage  in  practical, 
forward-looking  discussions  to  shape  our  final  cyber  workforce  de¬ 
velopment  report  to  the  CSAF.  Our  aim  was  to  break  down  stovepipes 
that  AFRI  discovered  by  bringing  together  the  individual  skills  of 
participants  from  multidisciplinary 
backgrounds  to  contribute  toward 
developing  a  more  effective  cyber 
workforce.  This  forum  helped  to  gen¬ 
erate  rapid  insights  into  key  areas  re¬ 
lated  to  developing  the  future  cyber 
workforce  and  the  sharing  of  expec¬ 
tations  and  experiences  on  viable,  near-term  strategies  for  transform¬ 
ing  that  workforce.  To  obtain  the  best  balance  between  the  needs  for 
focused  and  explorative  discussions,  the  team  limited  attendance  to 
20  people.  Participants  were  chosen  from  across  the  interagency  on 
the  basis  of  their  expertise  or  involvement  in  cyber  workforce  devel¬ 
opment.  The  output  from  the  advisory  group  formed  a  significant 
basis  for  study  conclusions. 


Output  from  This  Activity 

The  final  version  of  the  cyber 
force  development  study  on 
developing  long-term  cyber¬ 
security  human  capital  planning 
and  management  strategies 
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Phase  4:  Roll  Out  Project  Findings  to  CSAF,  Key  Air 
Force  Stakeholders,  and  Project  Participants 

The  last  step  of  the  project  was  to  deliver  the  final  study  results  to 
the  CSAF  and  other  stakeholders  within  AETC,  AU,  and  the  Air 
Force  chain  of  command.  This  step  is  crucial  to  presenting  relevant 
information  about  the  cultures  of  cyberspace  operators  examined  in 
the  case  studies  and  assuring  that  our  insights  continued  to  be  rele¬ 
vant  for  the  CSAF.  These  results  are  also  a  way  to  build  excitement 
around,  and  belief  in,  the  power  and  usefulness  of  cyberspace  opera¬ 
tions  as  an  aspect  of  national  power. 

The  research  team  briefed  the  CSAF  in  March  2015,  presenting  the 
study’s  overall  findings  and  recommendations.  This  larger  volume 
captures  the  research,  findings,  and  recommendations  in  greater  de¬ 
tail  than  was  possible  in  discussions  with  the  chief. 


Notes 

(All  notes  appear  in  shortened  form.  For  full  details,  see  the  appropriate  entry  in  the 
bibliography.) 

1.  Yannakogeorgos,  “Rise  of  IPv6,”  103-28;  Yannakogeorgos,  “USAF  Cyber  Edu¬ 
cation”;  Lowther,  “Rise  of  the  Millennial, ”  97-105;  and  Dacus  and  Yannakogeorgos, 
“Designing  Cybersecurity  into  Defense  Systems.” 

The  AFRI  team’s  presentations  of  its  findings  during  the  course  of  the  study  in¬ 
cluded  the  following  individuals:  CSAF,  assistant  vice-chief  of  staff,  and  deputy  chief 
of  staff  for  intelligence,  surveillance,  and  reconnaissance  (HAF/A2),  3  March  2015; 
Maj  Gen  Burke  E.  Wilson  (commander,  Twenty- Fourth  Air  Force,  and  commander, 
Air  Forces  Cyber),  on  or  about  16  January  2015;  Cyber  Advisory  Group,  subject: 
Read  Ahead,  10  July  2014;  CSAF,  subject:  Vector  Check,  late  April  2014;  Lt  Gen 
James  McLaughlin  (deputy  commander,  US  Cyber  Command  [USCC]),  3  March 
2014;  Hon.  Newt  Gingrich,  25  February  2014;  Lt  Gen  Harry  Raduege  (USAF,  re¬ 
tired),  Mr.  Frank  DiGiovanni  (director,  Force  Readiness  and  Training),  and  VAMD 
Michael  Rogers  (commander,  USCC),  7  February  2014;  and  Lt  Gen  Burton  Field 
(deputy  chief  of  staff  for  operations,  HAF/A3),  Maj  Gen  Jeff  Lofgren  (deputy  com¬ 
mander,  US  Air  Forces  Central  Command),  Lt  Gen  Jon  Davis,  USMC  (deputy  com¬ 
mander,  USCYBERCOM),  and  Dr.  Kamal  Jabbour  (Cyber  Security  Advanced 
Course  in  Engineering  Boot  Camp  program  founder),  12  September  2013. 

2.  In  addition,  the  near  prohibition  of  attending  non-DOD  conferences  at  this 
study’s  inception  meant  that  researchers  could  not  interview  large  numbers  of  cyber 
experts  at  professional  gatherings  where  they  are  available.  Having  to  knock  on  doz¬ 
ens  of  doors  significantly  slowed  and  complicated  the  research  process. 

3.  George  and  Bennett,  Case  Studies  and  Theory  Development,  18-20. 
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4.  Cyberspace  experts  were  the  first  set  of  authorities  the  research  team  inter¬ 
viewed.  Experts  from  numerous  backgrounds,  career  fields,  and  occupations  were 
interviewed  for  this  study. 

5.  The  cutoff  date  for  research  data  and  analysis  was  1  September  2014  although 
in  some  instances  more  current  data  is  cited. 

6.  Creswell,  Qualitative  Inquiry  and  Research  Design,  135;  and  Dalkey  and 
Helmer,  “Experimental  Application  of  the  Delphi  Method,”  458-67.  Originally  de¬ 
veloped  by  the  RAND  Corporation  in  the  early  1950s,  the  Delphi  method  is  used  to 
“obtain  the  most  reliable  consensus  of  opinion  of  a  group  of  experts.  It  attempts  to 
achieve  this  by  a  series  of  intensive  questionnaires  interspersed  with  controlled  opin¬ 
ion  feedback”  (Dalkey  and  Helmer,  “Experimental  Application  of  the  Delphi 
Method,”  458). 


Chapter  2 

Connecting  Technology  and  Policy 

Cyberspace  exists  where  the  wave-particle  duality  of  radiation, 
when  modulated  with  bits,  creates  an  information  flow  that  moves 
across  a  man-made  physical  infrastructure.  The  laws  of  physics 
bound  the  movement  of  data  across  computer  networks,  the  use  of 
which  is  advanced  technologically  by  man  and  often  restricted  by 
policy.  The  man-made  portion  of  cyberspace  is  built  on  core  proto¬ 
cols  and  standards  developed  and  codified  by  standard-setting  orga¬ 
nizations.  These  organizational  precepts  dictate  the  extent,  configura¬ 
tion,  and  makeup  of  the  entirety  of  cyberspace.  Other  regulations 
defining  the  general  rules  of  the  road  and  technology  capabilities  for 
operating  in  cyberspace  come  from  international  standard- setting 
organizations  and  the  DOD. 

Domestically,  policy  not  only  regulates  the  acquisition  of  informa¬ 
tion  technology,  weapons  platforms,  and  the  IT  integrated  onto  those 
platforms  but  also  guides  the  use  of  technology  at  the  tactical,  opera¬ 
tional,  and  strategic  levels  of  warfare  operations.  Similarly,  personnel 
policies  affect  the  makeup  of  the  cyberspace  workforce.  Government 
personnel  are  managed  via  Office  of  Personnel  Management  (OPM) 
policies  and  guidelines.  Thus,  not  only  the  physical  infrastructure  but 
also  the  various  policies  established  for  cyberspace  limit  its  boundaries 
and  use.  Figure  4  illustrates  some  of  the  technologies  and  policies  that 
affect  cyberspace  and  the  cyberspace  workforce.  This  chapter  dis¬ 
cusses  the  interplay  between  technology  and  select  laws  and  policies. 

Another  focus  is  technological  trends  that  Air  Force  planners 
should  include  when  forming  human  capital  strategies.  The  Air  Force 
will  misallocate  human  cyberspace  capital  if  it  recruits,  educates, 
trains,  and  equips  cyberspace  operators  for  the  technological  realities 
of  today  without  considering  what  the  cyberspace  landscape  may 
look  like  in  2020.  Admittedly,  it  is  a  fool’s  errand  to  try  to  predict 
technology  trends  in  a  domain  that  evolves  rapidly.  However, 
throughout  the  course  of  the  study,  we  discovered  that  many  inter¬ 
viewees  focused  on  the  cyberspace  workforce  within  the  paradigm  of 
today’s  technology. 

Because  parts  of  the  cyberspace  environment  change  more  rapidly 
than  in  other  domains  (e.g.,  Moore’s  law  regarding  the  doubling  of  data 
density  on  integrated  circuits  about  every  18  months),  the  Air  Force  and 
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DOD  must  prepare  for  the  next  generation  of  cyberspace  conflict  by 
evaluating  how  technological  trends  will  affect  cyberspace  workforce 
requirements.  For  example,  the  Joint  Information  Environment  (JIE)  is 
introducing  a  cloud  computing  paradigm  for  providing  applications 
and  services  to  the  DOD.1  This  evolution  has  the  potential  to  reduce 
manpower  requirements  for  traditional  DOD  information  network 
operations  due  to  its  anticipated  efficiencies.2 


Law  and  Policy 


Domestic 


Titles:  5,  6, 10, 14, 15, 17,18, 
32,  44,  50 

Office  of  Management  and 
Budget/OPM  mandates 
Executive  orders 
NSS,  NMS,  AF/joint  doctrine0 
Clinger-Coen  Act 
Computer  Fraud  &  Abuse  Act 


International 


Law  of  armed  conflict 
Council  of  Europe 
Cybercrime  Convention 
World  Intellectual  Property 
Organization  agreements 
Cyber  norms 
ICANN/IETF/W3Cd 
International 

Telecommunications  Union 
Bilateral  agreements, 
combatant  command 
theater  cooperation  plans 


Figure  4.  Technologies  and  policies  affecting  cyberspace  operations 


transmission- control  protocol/Internet  Protocol,  file  transfer  protocol,  hypertext  transfer 

protocol,  Internet  Protocol  version  6 

bDomain  Name  System,  generic  top-level  domain  names 

cNational  Security  Strategy,  National  Military  Strategy 

internet  Corporation  for  Assigned  Names  and  Numbers,  Internet  Engineering  Task  Force, 
World  Wide  Web  Consortium 
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Another  example  of  the  change  in  the  cyberspace  landscape  is  in 
broadband  and  mobile  technologies.  The  importance  of  the  electro¬ 
magnetic  spectrum  for  cyberspace  operations  will  increase  as  these 
technologies  continue  to  be  exploited.  Thus,  cyberspace  operators  will 
face  spectrum  management  challenges — something  they  have  not  his¬ 
torically  considered  since  their  traditional  focus  has  been  on  the  logical 
elements  of  cyberspace. 

Since  cyberspace  workforce  planners  must  consider  how  the  future 
cyberspace  landscape  may  look,  the  following  discussion  identifies 
potential  game-changing  technologies  and  policies  that  could  affect 
cyberspace  personnel  requirements.  The  DHS  National  Initiative  for 
Cybersecurity  Education  (NICE)  Cyber  Workforce  Framework  is  an 
excellent  tool  to  organize  the  knowledge,  skills,  and  abilities  (KSA)  for 
the  military  and  civilian  workforce.  This  tool  is  helpful  to  Air  Force 
and  national  cyberspace  workforce  planners  and  managers,  but  they 
must  also  be  able  to  recognize  technological  and  policy  shifts  that 
could  influence  training  and  education  requirements.  It  is  beyond  the 
scope  of  this  study  to  provide  a  comprehensive  overview  or  forecast  of 
technology  trends  and  drivers.  However,  this  information  provides  a 
basis  to  stimulate  strategic  discussions  on  issues  pertaining  to  core 
curriculum  design,  training  needs,  workforce  composition,  and  other 
areas  related  to  the  development  of  the  future  USAF  cyberspace  force. 

Comparing  Information  Technology 
and  Operational  Technology 

The  implications  of  merging  IT  into  platforms  and  using  it  to  com¬ 
mand  and  control  military  operations  are  the  soft  underbelly  of  all  Air 
Force  core  missions.  Airlift,  for  example,  is  not  possible  without  cyber¬ 
space  enabling  such  an  operation — take  Air  Force  One  for  example. 
The  Air  Force  provides  the  air  transport  for  the  president  of  the  United 
States  on  the  Air  Force  One  VC-25.  Although  all  aircraft  have  com¬ 
puter  networks  embedded  within  them,  Air  Force  One  has  “state  of 
the  art  navigation,  electronic  and  communications  equipment . . .  and 
the  capability  for  in-flight  refueling.”3  It  is  the  responsibility  of  Twenty- 
Fourth  Air  Force  to  assure  the  mission  of  Air  Force  One  by  providing 
cybersecurity  support  to  the  president.4  Thus,  cyberspace  is  an  en¬ 
abler  for  the  air  operations  of  Air  Force  One. 
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Indeed,  cyberspace  is  often  viewed  as  an  enabler  for  all  air  opera¬ 
tions  and  the  core  missions,  not  just  those  of  Air  Force  One.  Such 
outlooks  are  perpetuated  by  academic  discussions  about  whether 
cyberspace  is  a  separate  domain.  For  instance,  one  argument  is  that 
“understanding  cyberspace  as  a  warfighting  domain  is  not  helpful 
when  it  comes  to  understanding  what  can  and  should  be  done  to  de¬ 
fend  and  attack  networked  systems.”  Yet  later  Martin  Libicki  argues, 
“Such  a  stance  suggests  that  the  term  be  totally  avoided,  but  since  [I 
have]  no  intention  of  following  such  advice,  the  second-best  alterna¬ 
tive  is  to  use  the  term  carefully.”5  Two  problems  arise  here.  The  first  is 
that  cyber  operations  are  more  than  the  defense  of  networks  and  net¬ 
worked  systems.  The  second  is  that  not  identifying  cyberspace  as  a 
domain  prevents  the  vast  military  culture  from  giving  cyberspace  the 
attention  it  deserves  in  terms  of  organizing,  training,  and  equipping 
for  war — a  point  that  Libicki  concedes. 

Not  understanding  cyberspace  as  a  domain  of  warfare  risks  relegat¬ 
ing  it  to  a  realm  of  desktop  computers  rather  than  mission-essential 
components  in  a  non- cyber- educated  commander’s  mind.  Cyber¬ 
space  is  more  than  just  a  computer  system  that  allows  information  to 
flow  from  one  commander  to  another.  Viewing  it  as  a  mere  enabler 
also  has  a  negative  effect  on  the  career  field,  which  becomes  synony¬ 
mous  with  providing  DODIN  operations  rather  than  a  force  provid¬ 
ing  operational  effects.  Failure  to  identify  cyber  as  an  operational 
domain  of  warfare  also  prevents  commanders  from  utilizing  existing 
joint  doctrine.  They  cannot  begin  mapping  their  missions  depen¬ 
dence  on  cyberspace  to  defend  key  assets  at  the  right  time  if  they  do 
not  recognize  the  dependence  of  cyber  on  their  mission.  Neither  can 
they  maneuver  in  this  space  to  provide  strategic  sovereign  options  to 
the  president.  Further,  as  confirmed  in  our  interviews  across  the  cyber 
career  fields,  these  perceptions  of  cyber  as  an  enabling  rather  than 
operational  domain  of  warfare  demoralize  cyberspace  operators  and 
disincentivize  computer  and  electrical  engineers  from  entering  the 
officer  ranks  as  cyberspace  officers  (see  chap.  7).  Ultimately,  such  views 
limit  the  utilization  of  cyberspace  operators  when,  in  fact,  they  could 
provide  a  cost-effective  way  for  the  Air  Force  to  project  power.  They 
also  create  conflict  between  cyberspace  operators  and  the  decision 
makers  who  may  one  day  ask  them  to  produce  effects  in,  through,  or 
by  means  of  cyberspace. 

Hence,  operationalizing  the  domain — rather  than  relegating  it  to 
the  status  of  an  enabler  for  core  functions — is  essential  to  fully  utilizing 
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the  promise  of  cyberspace  operations.  Interesting  academic  argu¬ 
ments  about  the  “Platonic  forms”  of  cyberspace  aside,  cyberspace  will 
continue  to  serve  as  an  enabler  until  embraced  as  a  fully  operational 
domain.  At  that  time,  commanders  should  understand  mission  de¬ 
pendencies  on  cyber,  and  decisions  about  priorities  should  be  crafted 
around  the  potential  availability  and  integrity  of  systems  that  can  be 
put  at  risk. 

The  popular  perception  of  cyberspace  as  only  the  network  is  a  par¬ 
ticularly  troubling  finding  of  our  study.  Just  as  in  traditional  kinetic 
warfare,  the  spectrum  of  operations  in  cyberspace  is  large  and  ranges 
from  traditional  intelligence  activities  to  those  that  aim  to  damage 
and  destroy  physical  property  (fig.  5).  Across  this  spectrum,  different 
platforms  are  affected.  Some  activities  by  nefarious  actors  in  cyber¬ 
space  may  not  warrant  a  response  by  the  US  military.  Others  could 
prompt  the  use  of  force  or  a  physical  military  attack.  USCYBERCOM 
has  defined  actions  that  may  require  the  use  of  force  as  those  that 
misuse  cyberspace  and  result  in  physical  damage,  destruction,  injury, 
or  death.  Such  activities  entail  the  creation  of  malicious  effects  in 
cyber-physical  systems  or  operational  technology  (OT).  OT  in¬ 
cludes — but  is  not  limited  to — industrial  control  systems  (ICS), 
building  control  systems  (BCS),  and  embedded  processors  and  con¬ 
trollers  found  in  weapons  platforms.  We  emphasize  the  distinction 
between  these  and  ITs  that  exist  to  facilitate  corporate  processes  and 
do  not  have  an  immediate  operational  impact. 


Deletions/Denial  of  Service/Disruption/Digital  Damage 

Interrupt  the  flow  of  information  or  function  of 
information  systems  without  physical  damage  or  injury 


Physical  Effect 

Results  in  physical  damage  or 
destruction,  injury,  or  death 


Access/Exploitation 

Digital  intelligence 


Figure  5.  Spectrum  of  operations  in  cyberspace.  (Courtesy  of  Judge 
Advocate,  USCYBERCOM,  Fort  Meade,  MD.) 

The  unique  characteristics  of  OT  do  not  allow  for  traditional  IT 
paradigms  of  cybersecurity  to  prevent  intrusions,  detect  malicious 
code,  and  conduct  digital  forensics  after  the  event.  Technologically 
these  differences — in  addition  to  challenges  to  conducting  traditional 
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IT  cybersecurity  on  remote  sensors  and 
programmable  logic  controllers  (PLC) — 
make  patch  configuration/management, 
attack  identification,  and  attribution 
difficult.  Table  2  illustrates  the  differing 
operating  paradigms  of  IT  and  OT  sys¬ 
tems  (the  latter  using  the  example  of  ICSs). 

Table  2.  IT  system  and  ICS  comparison 


Given  that  risks  to  Air  Force 
core  missions  from  cyber 
dependencies  are  platform 
specific,  we  emphasize  the 
importance  of  distinguishing 
between  IT  and  OT. 


Attribute 

Information  technology 
system 

Industrial  control 
system 

Confidentiality 

Data  confidentiality  and 
integrity  are  paramount. 

Low 

Integrity 

Primary  focus  is  protecting 

IT  assets  and  the  informa¬ 
tion  stored  on  or  transmitted 
via  these  assets. 

Primary  goal  is  to  protect 
edge  clients  (e.g.,  field 
devices  such  as  process 
controllers). 

Central  server  may  require 
more  protection. 

Protection  of  central 
server  is  also  important. 

Availability 

Fault  tolerance  is  less  im¬ 
portant — momentary  down¬ 
time  is  not  a  major  risk. 

Less  critical  emergency 
interaction 

Fault  tolerance  is  essen¬ 
tial — even  momentary 
downtime  may  not  be 
acceptable. 

Response  to  human  and 
other  emergency  interac¬ 
tion  is  critical. 

Authentication 

Tightly  restricted  access 
control  can  be  implemented 
to  the  degree  necessary  for 
security. 

Access  to  ICS  should  be 
strictly  controlled  but 
should  not  hamper  or 
interfere  with  human- 
machine  interaction. 

Major  risk 
impact 

Delay  of  business 
operations 

Regulatory  noncompli¬ 
ance,  environmental  im¬ 
pacts,  loss  of  life,  equip¬ 
ment,  or  production 

Component 

lifetime 

3-5  years 

1 5-20  years 
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Table  2  ( continued ) 


Attribute 

Information  technology 
system 

Industrial  control  system 

Access  to 
components 

Components  are  usually 
local  and  easy  to  access. 

Components  can  be  isolated 
and  remote,  requiring  exten¬ 
sive  physical  effort  to  gain 
access  to  them. 

Operating 

systems 

Designed  for  use  with 
typical  operating  systems. 

Upgrades  are  straight¬ 
forward  with  the  availability 
of  automated  deployment 
tools. 

Differing  and  possibly  pro¬ 
prietary  operating  systems, 
often  without  security  capa¬ 
bilities  built  in. 

Software  changes  must  be 
carefully  made,  usually  by 
software  vendors,  because  of 
the  specialized  control  algo¬ 
rithms  and  perhaps  modi¬ 
fied  hardware  and  software 
involved. 

Change 

management 

Software  changes  are  ap¬ 
plied  in  a  timely  fashion  in 
the  presence  of  good  secu¬ 
rity  policy  and  procedures. 

The  procedures  are  often 
automated. 

Software  changes  must 
be  thoroughly  tested  and 
deployed  incrementally 
throughout  a  system  to 
ensure  that  the  integrity 
of  the  control  system  is 
maintained.  ICS  outages 
often  must  be  planned  and 
scheduled  days/weeks  in 
advance.  ICS  may  use  op¬ 
erating  systems  that  are  no 
longer  supported. 

Adapted  from  National  Institute  of  Standards  and  Technology,  Special  Publication 
800-82,  Guide  to  Industrial  Control  Systems  (ICS)  Security  (Gaithersburg,  MD:  NIST, 
June  2011),  3-3-3-4. 


Because  of  OT’s  distinct  attributes,  cyberspace  personnel  who  work 
with  it  require  different  skill  sets  than  do  those  being  recruited  in  the 
core  cyberspace  Air  Force  specialty  codes  (AFSC)  (17  series,  1B4,  and 
3D).  The  engineering  field  (62E  in  particular)  should  be  teamed  with 
the  cyberspace  workforce  to  use  its  complementary  knowledge  sets  to 
identify  vulnerabilities  and  develop  cybersecurity  requirements.  The  Air 
Force  Institute  of  Technology  (AFIT)  ICS  test  bed  should  be  leveraged 
by  an  engineering/ cybersecurity  team  to  understand  vulnerabilities, 
develop  best  practices,  and  help  foster  trusted  partnerships.  Without 
these  relationships  in  place,  US  critical  infrastructure  will  continue  to 
be  at  risk  due  to  incorrect  operational  paradigms  being  applied  to  the 
defense  of  OT. 
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Focusing  on  OT  rather  than  IT  emphasizes  the  distinction  be¬ 
tween  the  two  communities  rather  than  detracts  from  the  network 
security  and  data  integrity  mission  sets.  The  US  homeland  defense 
mission  represents  a  specific  area  within  the  Air  Force  that  demands 
data  trustworthiness.  Cyberspace  operations  are  vital  to  this  mission 
in  at  least  two  ways.  First,  the  nations  early  warning  systems  and  their 
operators  transmit  information  through  cyberspace.  That  informa¬ 
tion  is  processed  by  data  analysts  for  exploitation  and  dissemination. 
An  early  warning  system  compromised  by  a  malicious  cyber  event  or 
an  unintended  interaction  between  a  system  and  user  could  leave  the 
nation  vulnerable  to  attack.  At  a  time  when  nuclear  and  ballistic  mis¬ 
sile  technologies  are  proliferating,  a  compromise  of  the  early  warning 
system  is  unacceptable.  Second,  command  and  control  for  air  sover¬ 
eignty  depends  on  elements  of  cyberspace  to  disseminate  critical  in¬ 
formation.  An  action  that  causes  delay  in  the  delivery  or  causes  com¬ 
manders  to  question  the  integrity  of  data  in  these  networks  at  a 
specific  time  conducive  to  an  adversarial  operational  objective  could 
seriously  degrade  a  core  homeland  defense  function.6  Consequently, 
the  information  assurance  of  homeland  defense  data  must  remain  a 
priority  for  the  United  States,  particularly  as  potential  adversaries  are 
developing  their  cyber-warfare  arsenals. 

Therefore,  a  key  challenge  in  the  field  of  cyber  operations  is  that 
much  of  the  debate  has  been  focused  on  traditional  information 
management  and  computer  networking.  These  are  traditional  IT 
roles.  However,  our  emphasis  on  developing  a  cyber  workforce  is  on 
those  with  expertise  in  OTs — encompassing  embedded  controllers  in 
weapons  systems  and  platforms  developed  by  the  commercial  sector 
and  upon  which  national  critical  infrastructure  and  core  Air  Force 
missions  rely.  Poor  system  design  of  OT  and  its  interface  with  physical 
processes  has  been  responsible  for  several  incidents  involving  destruc¬ 
tion.  One  such  example  in  the  private  sector  is  the  Pacific  Gas  and 
Electric  (PG&E)  gas  transmission  pipeline  explosion  on  9  September 
2010  in  San  Bruno,  California.  The  blast  was  the  result  of  pressure  re¬ 
lieving  and  limiting  devices  controlled  by  a  PLC  that  failed  to  protect 
against  accidental  overpressure  in  the  pipeline.  Sensors  erroneously 
reported  low  pressure,  causing  the  ICS  to  open  valves  automatically. 
This  malfunction  raised  the  pressure  above  safe  levels  and  created  an 
explosion,  excavating  a  crater  72  feet  long,  26  feet  wide,  and  28  feet 
deep  (fig.  6)7  To  contain  the  ensuing  fire,  “more  than  900  emergency 
responders  from  the  city  of  San  Bruno  and  surrounding  jurisdictions 
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executed  a  coordinated  emergency  response,  which  included  defen¬ 
sive  operations,  search  and  evacuation,  and  medical  operations.  Once 
the  flow  of  natural  gas  was  interrupted,  firefighting  operations  con¬ 
tinued  for  2  days.”8 


Figure  6.  PG&E  gas  transmission  pipeline  explosion.  Crater  and  ruptured 
pipeline  (top)  and  aerial  view  of  fire  (bottom).  (Reproduced  from  National 
Transportation  Safety  Board  [NTSBI,  Pacific  Cas  and  Electric  Company  Natural 
Gas  Transmission  Pipeline  Rupture  and  Fire,  San  Bruno,  California,  September 
9,  2010,  Pipeline  Accident  Report  NTSB/PAR-11/01  [Washington,  DC:  NTSB, 
30  August  2011],  1-2,  http://www.ntsb.gov/investigations/AccidentReports/Reports 
/PAR1 101  .pdf.) 
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From  a  manpower  perspective,  the  skill  sets  to  defend  from  potential 
attacks  of  this  type  or  to  create  such  effects  by  targeting  platforms  and 
processes  are  not  taught  in  typical  computer  science  (CS)  curricula. 
Computer  and  electrical  engineering  are  conducive  to  the  national 
security-critical  OT  on  which  the  Air  Force  must  focus.  Because  OT 
specialists  are  usually  computer  engineers  or  electrical  engineers,  cyber¬ 
space  human  capital  managers  have  a  manpower  challenge  since 
these  engineers  are  not  generally  the  focus  of  DOD  cyberspace  re¬ 
cruiting  in  the  17-series  career  field.  Most  engineers  tend  to  enter  the 
62E  (engineering)  career  field.  Most  17-series  personnel  are  thus 
from  the  CS  and  computer  networking  fields.  These  professions  typi¬ 
cally  concentrate  on  the  technologies  that  enable  data  and  informa¬ 
tion  to  flow  and  not  on  assuring  the  integrity  and  availability  of  infor¬ 
mation  that  may  affect  an  Air  Force  mission  and  fulfill  a  commander’s 
mission  objective. 

Irregular  cyberspace  warfare  is  a  growing  area  of  concern  because 
nonstate  actors  are  proving  adept  at  waging  cyberspace  warfare  from 
remote  locations  using  less-sophisticated  methods  and  equipment. 
The  reported  hacking  of  an  American  drone’s  video  feeds  by  Iranian- 
backed  insurgents  is  one  of  many  examples.9  Given  the  speed  with 
which  irregular  adversaries  can  learn  and  adapt,  the  Air  Force  will 
undoubtedly  face  opposed  network  operations  from  nonstate  actors 
in  the  years  ahead.  Establishing  the  right  balance  in  cyberspace  will 
prove  a  challenge  that  the  Air  Force  must  overcome  against  peer  and 
irregular  adversaries  alike.  Although  it  is  unlikely  that  the  Air  Force 
will  have  exclusive  responsibility  for  cyberspace,  the  service  should 
expect  to  ensure  its  own  ability  to  operate  in  the  cyberspace  domain. 
The  first  part  of  this  capability  is  understanding  the  difference  be¬ 
tween  IT  and  OT.  The  second  part  is  distinguishing  between  core  and 
peripheral  technologies  and  then  factoring  in  their  evolution  as  we 
prepare  to  fight  in  the  future. 

There  is  clear  evidence  that  China  and  Russia,  potential  adversar¬ 
ies  in  a  peer  competition,  are  investing  heavily  in  cyberspace  warfare 
capabilities.10  This  development  poses  a  very  real  risk  to  civil  and 
military  networks.  Not  only  can  such  capabilities  slow  or  disrupt  the 
flow  of  information  but  also  a  penetration  of  secured  networks  calls 
into  question  the  validity  of  the  very  data  upon  which  the  Air  Force 
relies.  Given  the  United  States’  conventional  advantage,  cyberspace  is 
an  attractive  target.  In  the  view  of  some  adversaries,  the  damage  done 
by  a  successful  cyber  attack  may  be  enough  to  preempt  American 
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involvement  in  a  crisis,  such  as  a  Chinese  attack  on  Taiwan.11  As  the  Air 
Force  moves  toward  further  network  integration  of  command  and 
control,  communications,  and  weapons  platforms,  an  adversary  with 
advanced  cyberspace  warfare  capabilities  will  pose  an  increasing  threat 
to  mission  objectives.12  Understanding  a  missions  dependence  on  cyber¬ 
space  will  prove  a  strategic  necessity  over  the  coming  generation. 

The  Air  Force’s  dependence  on  OT  to  conduct  missions  is  expected 
to  grow.  In  the  past  year  alone,  threat  actors  deploying  malware  such 
as  Sandworm  and  Black  Energy  have  increasingly  been  targeting  OT 
for  information- gathering  purposes.  The  Sandworm  malware  in  par¬ 
ticular  contains  modules  targeting  ICS  supervisory  control  and  data 
acquisition  (SCADA)  systems.  One  report  states  that  “given  the  func¬ 
tion  of  these  systems,  and  historical  precedents  such  as  Stuxnet  and 
destructive  incidents  in  the  [Persian]  Gulf,  we  are  still  weighing  the 
possibility  that  these  intrusions  could  be  reconnaissance-for-attack.”13 
These  cases  demonstrate  both  the  threat-actor  intent  and  the  fact  that 
when  OT  fails,  physical  infrastructures  and  lives  are  put  at  risk.  Had 
the  pipeline  explosion  been  a  malicious  act,  this  incident  would  have 
met  USCYBERCOM’s  definition  of  an  armed  attack  through  cyber¬ 
space.  Responding  to  such  an  attack  would  require  cyberspace  ex¬ 
perts  with  specific  knowledge  of  OTs.  This  expertise  is  typically  found 
in  the  fields  of  computer  engineering  (CE)  and  electrical  engineering 
(EE),  occupational  areas  that  are  not  traditionally  associated  with  cy¬ 
ber  operations  in  traditional  DODIN  or  DCO  specialties. 

Cyberspace  effects  on  physical  platforms  are  not  science  fiction. 
ICSs,  BCSs,  and  embedded  microprocessors  that  control  physical 
processes  are  all  parts  of  cyberspace  that  extend  beyond  the  conven¬ 
tional  paradigm  of  cyberspace  as  being  just  the  Internet.  Devices  that 
can  be  affected  by  a  malicious  cyber  event  can  cause  operational  dis¬ 
ruption  resulting  in  mission  failure,  property  damage  or  destruction, 
or  loss  of  life. 


Core  and  Peripheral  Technologies 

In  addition  to  identifying  the  conceptual  difference  between  IT 
and  OT,  this  study  distinguishes  between  core  and  peripheral  tech¬ 
nologies  to  address  another  common  cyber  myth:  that  cyberspace 
changes  in  rapid  cycles.  This  is  true  in  terms  of  computing  and  data 
flow  speeds,  but  core  technologies  remain  constant.  This  section  pro- 
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vides  a  brief  overview  of  core  and  peripheral  technologies  and  how 
they  are  affected  by  policy 

Core  cyberspace  technologies  include  the  underlying  internation¬ 
ally  standardized  protocols  such  as  file  transfer  protocol  (FTP),  Inter¬ 
net  Protocol  (IP),  and  802.1  lx  wireless  communications  protocols. 
Peripheral  technologies  are  those  that  are  built  on  core  technologies. 
The  standardization  of  these  peripheral  technologies  permits  global 
interoperability  of  networked  devices.  Take  the  case  of  the  relation¬ 
ship  between  core  Internet  technologies  and  the  applications  devel¬ 
oped  there  over  time.  The  World  Wide  Web  (WWW)  exists  only  be¬ 
cause  computers  interconnected  via  MAC  and  IP  addresses,  both 
core  protocols,  use  hypertext  transfer  protocol  (HTTP),  another  core 
element  of  cyberspace,  to  communicate  data  and  information  via  the 
Domain  Name  System  (DNS),  yet  another  core  technology.  This  core 
underlying  infrastructure  has  remained  more  or  less  the  same,  with 
minimal  version  changes  over  the  past  two  decades.  What  has 
changed,  and  continues  to  change  rapidly,  is  the  development  of  new 
applications  utilizing  the  core  Internet  platforms.  OTs  are  also  made 
up  of  core  technologies.  ICSs  have  proprietary  control  protocols  that 
allow  data  to  transit  from  sensors  to  remote  machines  or  operators. 
Peripheral  applications  are  then  built  on  top  of  the  core  ICS  plat¬ 
forms,  such  as  SCADA,  that  present  machine  data  to  users. 

Most  cyberspace  users  are  familiar  with  peripheral  technologies 
but  have  only  fleeting  knowledge  of  the  underlying  core  technologies, 
such  as  the  transmission-control  protocol  (TCP)/IP  networking  pro¬ 
tocol,  and  the  political  processes  by  which  they  are  established  as  in¬ 
ternational  standards.  The  importance  of  the  core  of  cyberspace  can¬ 
not  be  overlooked.  Since  cyber  is  a  man-made  domain,  understanding 
and  shaping  the  core  infrastructure  is  mission  critical.  Computer  sys¬ 
tems  are  able  to  send  information  that  other  computers  can  under¬ 
stand  because  of  common,  man-made  standards  that  machines  use 
to  send  and  receive  data.  Cyberspace  technologies  are  based  on  the 
work  of  computer  scientists  and  engineers  around  the  globe  who 
establish  the  standards  and  rules  according  to  which  the  Internet 
operates.  Many  of  these  standards  began  as  US  government  programs 
under  the  Defense  Advanced  Research  Projects  Agency  (DARPA), 
DISA,  or  other  projects  that  the  government  privatized  in  the  mid- 
1990s.  However,  current  protocols  and  standards  are  reaching  their 
limits  as  global  cyberspace  growth  has  exploded.  For  peripheral  tech¬ 
nology  growth  to  continue,  which  in  the  past  was  a  catalyst  for  in- 
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novation  and  prosperity  globally,  the  underlying  core  technologies 
need  to  change.  But  other  countries  are  becoming  leaders  in  the  de¬ 
velopment  of  the  next- generation  Internet. 

China,  for  instance,  is  making  great  leaps  forward  in  setting  stan¬ 
dards  for  the  future  of  cyberspace.  As  reported  in  2011  by  the  US- 
China  Economic  and  Security  Review  Commission,  “If  current 
trends  continue,  China  (combined  with  proxy  interests)  will  effec¬ 
tively  become  the  principal  market  driver  in  many  sectors,  including 
telecom,  on  the  basis  of  consumption,  production,  and  innovation.”14 
Furthermore,  participants  in  international  standards-setting  bodies 
have  noted  that,  as  a  result  of  Chinese  understanding  of  international 
standards-setting  agreements,  “Chinas  international  negotiators  are 
becoming  more  adept  than  those  in  the  United  States.  It  is,  therefore, 
no  longer  clear  whether  the  US  would  prevail  against  Chinese  efforts 
in  cases  of  standards  disputes  at  the  international  level.”15 

This  lack  of  US  government  leadership  in  the  future  of  Internet 
governance  at  the  standards-setting  bodies  has  implications  for  both 
national  security  and  mission  assurance.  In  the  national  security  con¬ 
text,  technical  management  of  the  protocols  and  standards  matters 
because  it  may  allow  adversarial  states  to  exert  power  and  influence 
over  the  underlying  cyber  infrastructure.  In  the  mission  assurance 
context,  creating  unique  protocols  for  military  interoperability  can 
minimize  the  common  vulnerability  landscape  and  thereby  increase 
adversaries’  costs  to  maintain  a  contested  environment.  One  research 
discussion  noted  that  the  Air  Force  Research  Faboratory  (AFRL) 
could  create  a  secure  protocol  for  military  applications  in  40  lines  of 
code.  So  developing  and  applying  this  capability  to  help  the  United 
States  return  to  a  strategic  leadership  role  in  future  cyberspace  devel¬ 
opment  are  not  as  cost  intensive  as  the  conventional  wisdom  sug¬ 
gests.  However,  they  do  require  a  significant  investment  in  attracting 
or  growing  an  educated  cyberspace  workforce. 

A  key  finding  of  the  research  team  is  that  potential  competitor  na¬ 
tions  are  shaping  the  standards-setting  bodies  that  will  determine  the 
functioning  of  the  foundation  of  cyberspace  in  the  future.  The  cyber¬ 
space  workforce  must  consist  of  people  educated  in  the  science  and 
mathematics  of  cyberspace  to  substantively  create  mathematically 
secure  core  technologies  as  well  as  to  contribute  to  standards-setting 
bodies.  The  DOD  and  USAF  should  document  their  roles  and  pro¬ 
vide  metrics  on  their  participation  and  position  with  Internet  gover¬ 
nance  bodies.  Global  norms  and  standards  stem  from  the  practices  of 
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nations  and  their  operational  forces.  Further,  due  to  the  community 
dynamics  of  individuals  within  the  bodies,  nations  must  maintain 
constant  contact  with  their  peers  within  each  standards-setting  com¬ 
munity,  as  the  Air  Force  does. 

Internet  Protocol  Version  Six 

Unbeknownst  to  many  people,  the  fundamental  structure  of  the 
Internet  is  changing  for  the  first  time  in  its  history  with  the  exhaustion 
of  Internet  Protocol  version  4  (IPv4)  and  the  adoption  of  Internet 
Protocol  version  6  (IPv6).  International  calls  for  transitioning  to  IPv6 
have  been  ongoing  since  1996.  These  calls  intensified  in  2013  at  the 
Ministerial  Conference  on  the  Information  Society  in  Latin  America 
and  the  Caribbean  held  in  Montevideo,  Uruguay.  At  this  conference, 
the  Internet  Corporation  for  Assigned  Names  and  Numbers  (ICANN) 
issued  a  declaration  stating  that  the  “transition  to  IPv6  [must]  remain 
a  top  priority  globally”  and  that  “in  particular  Internet  content  pro¬ 
viders  must  serve  content  with  both  IPv4  and  IPv6  services  to  be  fully 
reachable  on  the  global  Internet.”16  The  Air  Force  has  a  tremendous 
opportunity  and  responsibility  to  lead  the  DOD  and  nation  in  the 
transition  to  IPv6.  This  conversion  will  enable  the  Air  Force  to  better 
accomplish  its  mission  but  will  require  the  service  to  train  its  cyber¬ 
space  operators  to  keep  pace  with  technological  change.  As  Gen  Mark 
A.  Welsh  III,  Air  Force  chief  of  staff,  emphasized  in  his  foreword  to 
the  latest  Air  Force  strategy  document,  “The  Air  Forces  ability  to 
continue  to  adapt  and  respond  faster  than  our  potential  adversaries  is 
the  greatest  challenge  we  face  over  the  next  30  years.”17  With  China 
leading  the  world  in  operational  deployment  of  IPv6-o«Zy  networks, 
it  is  time  for  the  DOD  and  nation  to  get  serious  about  enabling  IPv6 
on  hardware  it  already  owns.18  However,  the  United  States  faces  issues, 
or  myths,  that  are  important  to  understand  in  transitioning  to  IPv6. 

Myth  1:  Global  IPv4  depletion  trends  do  not  apply  to  the  DOD 
and  Air  Force.The  first  myth  is  that  IPv4  address  depletion  is  not  a 
problem  for  the  DOD  since  a  large  allocation  of  worldwide  IPv4  ad¬ 
dresses  was  reserved  for  national  security  purposes.19  Historically, 
the  DOD  has  been  a  repository  of  technical  expertise  regarding  the 
Internet — partly  due  to  the  Internet’s  initial  development  within 
DARPA.  Since  the  birth  of  the  Internet  at  DARPA,  the  DOD  has  been 
operating  all  “mil”  domains — a  top-level  domain  for  the  DOD’s  ex¬ 
clusive  use — and  the  DNS  name  servers  to  support  them.  Conse- 
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quently,  the  DOD  has  had  to  employ  the  expertise  necessary  to  main¬ 
tain  those  systems.  In  the  early  1990s,  the  DOD  acquired  a  significant 
amount  of  the  IPv4  space — 12  blocks  of  /8  block  space.  Since  each  /8 
block  contains  16,777,214  IP  addresses,  the  DOD  has  over  200  mil¬ 
lion  addresses  available  in  IPv4  space.  Similarly,  the  DOD  recently 
purchased  a  /13  block  of  IPv6  space — the  equivalent  of  42  decillion 
IP  address  spaces.20 

Conventional  wisdom  across  much  of  the  Air  Force  is  that  the 
DOD  and  Air  Force  have  no  reason  to  worry  about  IP  address  deple¬ 
tion.  Indeed,  only  a  very  small  percentage  of  the  Air  Force  network 
uses  any  IPs  from  those  12  allocations.  Huge  chunks  of  the  Air  Force 
network  predate  the  assignment  of  those  /8  networks,  thus  skewing 
DOD  projections  of  estimated  future  use.  Getting  a  more  accurate 
estimate  would  require  analyzing  all  IPv4  addresses  that  the  Air  Force 
uses — most  of  which  were  directly  acquired  before  the  DOD  received 
its  large  allocations.21  Calculations  on  the  publicly  available  DOD 
Network  Integration  Center  (DODNIC)  “WHOIS”  database  reveal 
that  the  DOD  has  slightly  more  than  317  / 16  networks  currently 
listed  as  reserve  networks  (RNET)  allocated  for  future  assignment.22 
There  is  also  a  mixture  of  smaller  allocations.  Of  the  317  / 16  net¬ 
works,  one  unused  /8  network  (29.0.0.0/8)  is  currently  being  held  in 
reserve.  This  single  unused  /8  network  is  not  adequate  address  space 
for  future  applications  to  support  the  entire  DOD. 

Internet  Protocol  address  space  is  critical  to  delivering  elements  of 
power  in  all  Air  Force  core  missions,  which  require  large  amounts  of 
such  space  per  platform  to  support  a  robust  and  redundant  commu¬ 
nications  infrastructure.  These  platforms  must  have  multiple  network 
switches  to  ensure  both  resilient  command  and  control  and  mission 
objectives.  One  example  that  illustrates  this  point  within  the  global 
mobility  mission  involves  the  new  KC-46  tanker  aircraft.  By  2027, 
179  new  KC-46  aircraft  are  expected  to  be  assembled,  all  of  which 
need  IP  address  space.23 

Another  example  highlighting  the  need  for  increased  IP  address 
space  is  identified  in  the  Air  Force  strategy  document  America’s  Air 
Force:  A  Call  to  the  Future:  “Expanding  requirements  and  a  growing 
threat  to  high  cost  air-breathing  assets  will  also  necessitate  a  shift 
from  an  architecture  focused  on  dedicated  ISR  [intelligence,  surveil¬ 
lance,  and  reconnaissance]  platforms  to  one  based  on  a  diverse  net¬ 
work  of  sensors  arrayed  across  the  air,  space,  and  cyber  domains, 
placing  a  premium  on  the  ability  to  draw  data  from  any  and  all  US 
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systems.”24  The  flexible,  global,  and  integrated  ISR  capability  requires 
the  expanded  address  space  provided  in  IPv6  to  network  a  massive 
number  of  sensors  together.  This  vast  address  space  would  give  sen¬ 
sors  their  own  static  IP  addresses. 

Myth  2:  Current  education  and  training  in  IPv6  is  sufficient. 
The  second  myth  about  the  transition  to  IPv6  has  to  do  with  the  edu¬ 
cation  and  training  of  cyberspace  operators.  A  significant  portion  of 
Air  Force  networking  equipment  is  IPv6  capable;  however,  without 
properly  trained  cyberspace  operators,  IPv6  should  not  be  enabled. 
Serious  security  vulnerabilities  are  associated  with  enabling  IPv6  on 
Air  Force  networks.  For  example,  many  host-based  defense  and  fo¬ 
rensics  tools  cannot  handle  the  multiple  addresses  of  IPv6  because  of 
the  enormous  size  of  the  smallest  IPv6  subnets,  which  are  4  billion 
times  larger  than  the  entire  IPv4  range.  An  IPv6  scanner  could  take 
days  or  weeks  to  find  all  hosts  on  the  Air  Force  network,  let  alone 
actually  scan  them  for  vulnerabilities. 

Another  problem  is  in  the  ability  of  IPv4  intrusion  detection  sys¬ 
tems  (IDS)  to  inspect  the  contents  of  an  IPv6-tunneled  packet  and 
vice  versa.  Because  IPv4  IDSs  cannot  inspect  IPv6-tunneled  packets, 
the  enabling  capability  opens  Air  Force  networks  to  potential  secu¬ 
rity  vulnerabilities.  There  is  even  a  threat  of  exactly  when  the  network 
is  enabled  to  do  the  opposite  and  tunnel  IPv4  over  IPv6.  Enabling 
IPv6  on  Air  Force  networks  without  the  appropriate  network  defense 
tools  and  without  properly  educated  and  trained  operators  could 
leave  those  networks  susceptible. 

Without  experienced  operators,  the  United  States  could  face  expo¬ 
sure  to  threat  actors  who  have  years  of  experience  and  understand¬ 
ing.  The  Air  Forces  cyber  schoolhouses  presently  offer  an  insufficient 
two  hours  of  instruction  on  the  general  background  of  IPv6  in  their 
curricula.  Detailed,  specific  IPv6  training  should  be  required,  but 
within  the  DOD,  some  individuals  view  such  training  as  unnecessary 
because  it  does  not  represent  the  current  operational  reality.25 

Instead,  the  preference  is  to  reserve  that  type  of  training  for  future 
cyber  follow-on  training  units  (FTU).  These  FTUs  will  train  cyber¬ 
space  operators  in  the  latest  capability  advancements  as  they  move  be¬ 
tween  assignments.  Thinking  that  cyberspace  operators  can  simply  be 
trained  after  the  capability  becomes  operational  is  flawed.  Instead,  they 
need  hands-on  experience  before  technology  is  made  operational — the 
Air  Force’s  procedure  with  other  weapon  systems. 
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One  National  Institute  of  Standards  and  Technology  (NIST)  re¬ 
port  notes  that  “prevention  of  unauthorized  access  to  IPv6  networks 
will  likely  be  more  difficult  in  the  early  years  of  IPv6  deployments.”26 
If  the  defense  of  Air  Force  and  DOD  networks  is  going  to  become 
more  difficult  with  the  implementation  of  IPv6,  then  cyberspace  op¬ 
erators  should  have  even  more  time  to  become  familiar  with  IPv6. 
They  must  have  time  to  become  highly  proficient  experts,  just  as  it 
takes  time  for  pilots  to  become  experts  in  their  airframes.  The  Air 
Force  should  begin  a  robust  IPv6  educating  and  training  program 
now  so  that  cyber  warriors  will  be  ready  when  IPv6  is  enabled  on  Air 
Force  networks. 

Critics  might  argue  that  there  are  not  enough  hours  in  the  cyber¬ 
space  curriculum  for  both  IPv4  and  IPv6.  However,  given  the  inter¬ 
relationship  between  the  protocols,  teaching  IPv6  also  effectively 
teaches  principles  of  IPv4.  At  a  minimum,  the  Air  Force  must  also 
ensure  that  Airmen  already  in  cyber  career  fields  get  more  exposure 
to  IPv6.  One  short-term  solution  is  for  cyberspace  operators  to  com¬ 
plete  courses  through  the  Federal  Virtual  Training  Environment 
(FedVTE)  as  more  long-term  training  solutions  are  developed.27 

Myth  3:  Conversion  is  too  expensive  in  a  time  of  austerity.  An¬ 
other  myth  about  the  transition  to  IPv6  is  the  cost.  According  to  crit¬ 
ics,  the  right  time  to  conduct  the  transition  is  not  in  a  budget-con- 
strained  environment  with  competing  priorities — an  assertion  that  is 
partly  true.  The  cost  of  conversion  does  not  he  in  purchasing  IPv6-ca- 
pable  equipment  but  in  training  and  educating  cyberspace  warriors. 

Currently,  the  DOD  network  architecture  is  already  capable  of 
supporting  the  conversion  to  IPv6.  The  Air  Force  Networking  Inte¬ 
gration  Center  (AFNIC)  has  been  an  advocate  for  IPv6  since  2002, 
and  several  federal  requirements  have  been  issued  since  then  man¬ 
dating  IPv6-capable  equipment.  In  2003  the  DOD  issued  a  memo¬ 
randum  requiring  the  purchase  of  IPv6-capable  equipment  to  replace 
old  items  during  the  normal  tech  refresh.28  Section  221  of  the  2006 
National  Defense  Authorization  Act  (Public  Law  109-163)  has  an 
IPv6  inspection  requirement  for  the  Air  Force  chief  information  of¬ 
ficer  (CIO)  to  use  as  a  metric  for  individual  acquisition  programs; 
any  program  that  fails  the  inspection  requirement  could  see  its  fund¬ 
ing  delayed.29  The  purchase  of  IPv6-capable  equipment  became  a  fed¬ 
eral  regulation  in  December  2009  when  the  Civilian  Agency  Acquisi¬ 
tion  Council  and  the  Defense  Acquisition  Regulations  Council  issued 
a  ruling  amending  the  Federal  Acquisition  Regulations.30  Conse- 
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quently,  converting  the  physical  DOD  network  architecture  to  IPv6 
incurs  no  additional  cost.31 

The  expense  associated  with  converting  to  IPv6  lies  in  educating 
and  training  Air  Force  and  DOD  cyberspace  operators.  If  current  cy¬ 
berspace  warriors  are  not  trained  on  IPv6  immediately,  the  Air  Force 
and  DOD,  at  a  minimum,  will  be  required  to  double  their  cyberspace 
manpower  during  the  transition  to  IPv6.  The  transition  would  re¬ 
quire  two  staffs  of  network  administrators  and  support  personnel: 
one  trained  in  IPv4  and  the  other  trained  in  IPv6.  In  2005  the  NIST- 
estimated  cost  of  training  one  IPv6  expert  was  about  $2,000.32  Al¬ 
though  that  cost  has  probably  increased,  training  cyberspace  opera¬ 
tors  on  IPv6  now  would  still  be  less  expensive  in  the  long  run.  Doing 
so  would  result  in  a  cyber  workforce  of  IPv6  experts  by  the  time  a 
transition  is  mandated  versus  maintaining  two  distinct  staffs  required 
to  ensure  network  integrity  during  the  transition.  Starting  now  to 
prepare  for  a  potential  best  case  2029  depletion  date  will  save  the  Air 
Force  and  DOD  money  they  will  inevitably  have  to  spend. 

Myth  4:  Foreign  actors  are  sitting  idly  by.  The  fourth  and  final 
myth  exposed  by  this  study  deals  with  foreign  competitors.  As  dis¬ 
cussed  in  the  policy  chapter,  the  domination  of  IPv6  by  foreign  actors 
poses  a  tremendous  challenge  to  assuring  mission  success.  Our  Chi¬ 
nese  competitors,  among  others,  are  gaining  experience  in  operating 
IPv6  networks  while  the  DOD  and  Air  Force  seem  to  be  ignoring  the 
problem.  Current  DOD  CIO  strategies  outline  a  phased  approach  to 
transitioning  DOD  networks  to  full  IPv6.33  This  phased  approach  re¬ 
quires  IPv4/IPv6  dual  stacking — that  is,  running  the  two  networks  in 
parallel.  Dual  stacking  introduces  both  well-documented  and  un¬ 
known  security  vulnerabilities  that  will  take  time  for  our  cyber  op¬ 
erators  to  understand.  During  this  transition,  the  United  States  can 
expect  potential  adversaries  to  exploit  those  vulnerabilities  and  lever¬ 
age  their  inherent  advantages  of  IPv6  domination. 

Linguistic  Challenges  in  Cyber  Operations 

English  has  been  the  predominant  language  for  the  Internet  be¬ 
cause  of  the  preponderance  of  US-based  hosting  of  the  foundation  of 
networks  and  services,  but  its  continued  status  as  the  lingua  franca  is 
uncertain.  This  incertitude  is  especially  true  with  the  increased  fre¬ 
quency  of  calls  to  “limit  the  storage,  movement,  and/or  processing  of 
digital  data  to  specific  geographies,  jurisdictions,  and  companies” 
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around  the  world  to  include  non-English-speaking  countries.34  Air 
Force  cyberspace  operators  will  have  the  most  difficulty  operating  in 
environments  where  nation-states  develop  and  deploy  their  own  tele¬ 
communications  networks  or  alternate  DNS  systems  for  domestic 
use.  Indeed,  countries  such  as  China,  Iran,  and  Russia  have  already 
developed  and  deployed  such  communications  systems.35  Doing  so 
allows  a  nation-state  to  use  sophisticated  communications  routes  that 
require  an  educated  cadre  not  only  of  engineers  but  also  of  linguists 
specializing  in  the  languages  in  which  these  networks  will  function. 

This  capability  differs  from  simply  controlling  Internet  access 
points.  These  country- level  intranets  may  or  may  not  be  connected  to 
the  global  Internet,  and  the  trend  to  maintain  separation  is  growing.36 
Evidence  of  this  trend  is  the  Russian  development  of  a  Federal  Infor¬ 
mation  and  Telecommunications  System  (SFITS).  The  Russian  Fed¬ 
eral  Agency  for  Government  Communications  and  Information 
(FAPSI)  developed  SFITS  on  a  foundation  of  Russian-developed 
hardware  and  software  completely  disconnected  from  the  Internet.37 
With  this  system,  Russia  considers  itself  the  “only  country  which  is 
capable  of  providing  one-hundred  percent  security  for  consumers  at 
the  very  first  stage  of  the  mass  introduction  of  SFITS  in  daily  life.”38 

Along  with  the  rise  of  the  altnerative  Domain  Name  System 
(altDNS),  an  increasing  trend  is  the  use  of  non-Fatin  characters  in 
URFs  and  generic  top-level  domain  names  (gTFD).  ICANN  has  lim¬ 
ited  TED  extensions  such  as  .com  or  .org.  However,  in  2011  ICANN 
allowed  applicants  to  create  their  own  domain  name  extensions,  such 
as  “.culture.”  If  organizations  run  their  own  TTDs,  they  may  operate 
them  as  they  wish,  thus  making  the  gTFD  either  as  open  or  closed  to 
the  public  as  the  organization  wishes. 

In  addition  to  new  gTFDs,  the  use  of  non-Fatin  script  in  domain 
names  is  increasing.  In  the  past,  Fatin-based  characters  from  A  to  Z 
were  used  to  resolve  URFs,  but  ICANN  recently  launched  an  effort  to 
use  non-Fatin  scripts  in  URFs.  When  characters  from  Greek,  Persian, 
Cyrillic,  and  Chinese  languages  are  used  as  URFs,  more  users  will 
have  access  to  the  Internet  in  their  native  language.39  The  Internet  will 
be  open  to  masses  of  new  users  who  may  not  have  accessed  it  previ¬ 
ously  because  of  the  English  language  barrier.  Such  an  influx  presents 
a  significant  human  capital  dilemma  because  the  cultural  and  linguistic 
challenges  facing  the  cyberspace  profession  today  will  only  intensify. 
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Broadband  Mobility 

The  use  of  broadband  mobile  devices  is  another  significant  change 
in  the  cyberspace  landscape.  The  increase  in  broadband  mobility 
presents  both  opportunities  and  risks  for  US  military  operations.  In 
the  developing  world,  countries  tend  to  skip  over  the  plain  old  tele¬ 
phone  system  (POTS)  and  install  wireless  communications  infra¬ 
structures,  including  broadband  Internet  and  cellular  communica¬ 
tions.  Much  of  the  technology  used  to  develop  those  infrastructures 
comes  from  China.  Chinese  entities  such  as  Huawei  are  on  the  lead¬ 
ing  edge  of  developing  the  standards  of  next-generation  mobile  4G 
long-term  evolution  (LTE)  networks.40  Low-priced  Chinese-made 
computer  hardware  makes  such  networks  cost  effective  for  the  devel¬ 
oping  world.41 

Beyond  just  the  broadband  network  infrastructure,  different  chal¬ 
lenges  for  the  US  military  come  from  the  shift  in  interpersonal  com¬ 
munication  brought  about  by  mobile  broadband.  Mobile  broadband 
users  no  longer  have  to  wait  for  the  media  to  share  the  news  of  the  day — 
it  is  instantly  available  as  users  share  it  on  various  messaging  and  social 
media  services.  This  change  means  that  national  security  planners  and 
cyberspace  operators  must  take  into  account  how  specific  actions  will 
be  communicated  across  broadband  devices  on  such  networks. 

Because  of  this  shift  in  interpersonal  communications,  the  mili¬ 
tary  must  understand  the  importance  of  exploiting  the  mind  to 
achieve  effects  in  the  real  world.  Cyberspace  operators  also  have  to 
mitigate  potential  adversary  operations  that  seek  to  exploit  the  hu¬ 
man  mind.  Such  efforts  extend  well  beyond  terrorist  efforts  to  radi¬ 
calize  and  recruit  individuals  to  their  cause  and  have  broader  impli¬ 
cations  for  US  operations. 

Take,  for  example,  the  events  that  transpired  in  India  in  August 
2012.  After  short  message  service  (SMS)  (i.e.,  text  messages)  and  so¬ 
cial  media  messages  falsely  warned  of  impending  Muslim  attacks 
against  migrants  across  northeastern  India,  including  major  cities 
such  as  Bangalore,  mass  panic  and  exodus  of  targeted  populations 
ensued.  Indian  prime  minister  Manmohan  Singh  warned,  “What  is  at 
stake  is  the  unity  and  integrity  of  our  country.”42 

From  this  example,  it  is  clear  that  information  distributed  over 
broadband  mobile  networks  can  have  a  very  real  impact  on  a  large 
number  of  peoples  perceptions  of  the  world  around  them.  Those  views 
could  lead  them  to  actions  with  consequences  for  national  security. 
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Areas  where  cyberspace  and  neuroscience  overlap  must  therefore  be 
considered  in  developing  the  cyberspace  workforce  structure.  Broad¬ 
band  mobile  is  changing  the  cyberspace  landscape;  the  United  States 
must  identify  opportunities  to  counter  and  deter  adversarial  actions 
in  the  domain  and  articulate  the  military’s  role. 

Peripheral  Technologies  That  Will  Benefit 
from  Core  Technology  Trends 

Having  a  keen  understanding  of  existing  and  emergent  core  tech¬ 
nologies  such  as  IPv6  is  one  part  of  the  cyber  problem.  The  other  is 
assuring  that  rapidly  changing  peripheral  technologies  are  also  un¬ 
derstood  by  cyber  operators  and  career  field  managers  so  that  the 
workforce  tackling  the  problems  of  today  is  also  being  shaped  to  take 
into  account  tomorrow’s  technologies.  The  examination  below  is  by 
no  means  an  exhaustive  assessment  of  technologies  that  will  affect 
the  mission.  However,  these  key  technologies  will  shape  the  cyber 
environment  and  may  require  both  skilled  operators  and  material  in 
the  training  curriculum. 

Cloud  Computing  and  Big  Data 

The  NIST  defines  cloud  computing  as  a  model  for  “enabling  ubiq¬ 
uitous,  convenient,  on- demand  network  access  to  a  shared  pool  of 
configurable  computing  resources  (e.g.,  networks,  servers,  storage, 
applications,  and  services)  that  can  be  rapidly  provisioned  and  released 
with  minimal  management  effort  or  service  provider  interaction.”43 
An  increasing  trend  today  within  the  commercial  sector  is  locating 
many  independent  services  on  one  physical  host.  This  paradigm, 
from  an  operational  perspective,  allows  for  a  greater  tolerance  to  op¬ 
erate  resiliently  in  a  contested  environment.  Cloud  computing  per¬ 
mits  secure  computer  architectures  to  transparently  continue  opera¬ 
tions  in  the  face  of  multiple  faults  that  would  otherwise  cause  a  system 
to  fail.  Highly  resilient  systems  that  restart  quickly  and  restore  data 
contribute  to  such  operability.  In  a  virtual  environment,  sensors  detect 
virtualized  machine  failures  and  conduct  a  replacement  of  the  virtual 
machine  with  a  duplicate  backup  based  on  the  snapshot  of  a  trusted 
virtualized  environment.  Even  though  any  data  that  had  not  been 
backed  up  would  be  lost,  system  functionality  would  be  restored. 
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Virtualization  is  one  technology  proposed  as  a  solution  to  create 
more  resilient  systems  for  the  US  military.44  In  brief,  virtualization 
makes  it  easier  for  one  cyberspace  authority  to  install  and  manage 
instances  of  a  specific  operating  system  configuration.  This  capability 
lends  itself  to  automating  the  installation  of  the  same  operating  sys¬ 
tem  across  several  virtual  machines.  Such  massive  deployments  create 
software  monocultures  that  can  spread  malicious  software.  However, 
such  a  uniform  ecosystem  also  makes  deploying  patches  to  vulnera¬ 
bilities  more  efficient  and  effective.  The  major  risk  of  centralized 
management  of  virtual  assets  is  a  single  point  of  failure,  but  the  up¬ 
side  is  that  virtualized  environments  enable  the  protected  deploy¬ 
ment  of  security  services.  Although  this  benefit  enhances  mitigation 
efforts  against  rootkits  and  social  engineering  attacks,  other  risks — 
such  as  problems  with  anomalous  activity  detection — still  exist. 
Nonetheless,  the  efficiencies  of  cloud  computing  have  engendered  its 
increasing  use,  changing  the  future  cyberspace  landscape.  However, 
we  often  overlook  the  fact  that  virtualization  demands  intense  soft¬ 
ware  coding.  The  adoption  of  cloud  architectures  such  as  the  JIE  may 
create  operational  efficiencies  and  free  some  DODIN  operators  for 
retraining  into  other  mission  fields,  but  it  is  essential  that  our  opera¬ 
tors  also  have  a  more  solid  knowledge  of  computer  languages  and 
coding  best  principles. 

Ubiquitous  Computing 

Ubiquitous  computing,  also  known  as  the  Internet  of  things,  is 
based  on  the  idea  that  all  devices  everywhere  are  connected  through 
the  Internet  or  another  TCP/IP  network.  Although  this  concept  is 
not  yet  reality,  more  devices  are  adding  Internet  connectivity  to  their 
capabilities  and  can  communicate  with  other  devices  over  the  Internet. 
This  expanded  connectivity  is  expected  to  drastically  alter  the  way 
societies  function.  It  represents  a  paradigm  shift  away  from  networked 
laptops  and  desktops  toward  networked  objects  sensing  their  envi¬ 
ronments  and  communicating  what  they  sense  among  themselves. 

Ubiquitous  computing  does  not  change  core  Internet  topology. 
Rather,  it  is  a  shift  in  the  next  generation  of  Web  applications.  The 
world  is  on  the  cusp  of  entering  Web  3.0 — the  semantic  Web.  Web  1.0 
was  the  static  Web:  people  read  information  without  interacting  with 
the  media.  Web  2.0  is  the  interactive  and  social  web.  The  trend  toward 
Web  2.0  started  circa  2000  but  did  not  fully  take  off  until  later  in  the 
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first  decade  of  the  century  with  the  popularization  of  services  such  as 
YouTube  and  Facebook.  Web  3.0,  the  next  evolution  of  the  Web,  began 
at  the  start  of  the  second  decade  and  is  expected  to  intensify  into  the 
third  decade  of  this  century 

The  semantic  Web  involves  ubiquitous  computing — machines 
connecting  data  not  previously  linked.45  Machines  will  be  able  to  un¬ 
derstand  data  in  a  way  that  a  human  can  via  the  metadata.46  This  ca¬ 
pacity  is  more  than  an  extension  of  the  Internet  to  mobile  and  other 
devices;  it  includes  independent  systems  that  operate  on  their  own 
infrastructure  and  rely  only  partially  on  the  Internet.  These  objects — 
from  books  to  cars,  from  electrical  appliances  to  food — create  the  In¬ 
ternet  of  things.  Some  objects  may  have  their  own  IPv6  addresses 
while  others  will  be  embedded  in  complex  systems  and  use  sensors  to 
obtain  information  from  their  environments  (such  as  food  products 
that  record  the  temperature  along  the  supply  chain). 

Internet  Protocol  Television  and  Software-Defined  Radio 

The  rise  of  on-demand  video  and  audio  online  services  has 
prompted  a  shift  from  traditional  television  and  radio  to  Internet 
Protocol  television  (IPTV)  and  software-defined  radio.  These  tech¬ 
nologies  allow  for  the  broadcasting  of  audio  and  video  material  over 
a  packet-switch  IP  network.  However,  IPv4  networks  limit  the  trans¬ 
mission  to  a  unicast  model.  That  is,  in  terms  of  user  experience,  if 
someone  wants  to  change  a  program,  pressing  the  “next  channel” 
button  will  require  the  device  to  establish  a  new  connection,  creating 
a  lag  in  load  time  of  the  next  channel  or  program  being  requested. 
IPv6  solves  this  channel  load  delay  because  it  allows  for  multicasting. 

Standards  for  platforms  capable  of  running  IPTV  services  are  just 
now  emerging.  American  companies  such  as  AT&T  support  the  In¬ 
ternational  Telecommunication  Unions  (ITU)  G.hn  standard,  which 
allows  IPTV  services  to  evolve  into  a  format  resembling  the  seam¬ 
lessness  of  television  today.47  The  result  will  be  similar  to  the  change 
that  occurred  when  cable  and  satellite  broadcast  transformed  the 
television  landscape.  As  such,  IPTV  will  present  new  opportunities 
for  the  United  States  to  broadcast  messages  worldwide  with  the  capa¬ 
bility  to  target  specific  devices  or  send  generic  messages  to  large 
groups  of  devices.  While  these  opportunities  will  exist  on  the  open 
Internet,  extremist  entities  could  use  IPTV  in  conjunction  with  de- 
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vices  embedded  into  closed  networks  to  maintain  a  grip  on  the  minds 
of  their  followers  within  self-referential  environments. 

Air  Force  Acquisition  and  the  Cyber  Workforce 

Perhaps  the  more  critical  policy  decisions  affecting  technology  are 
those  guiding  our  acquisition  of  defense  cyber  systems.  Considerations 
in  this  area  include  the  need  to  standardize  systems  and  IT  configura¬ 
tions  across  the  Air  Force  and  to  create  a  small  cadre  of  officers  dual 
qualified  as  cyber  operators  and  acquisition  professionals.  Further, 
transitioning  to  IPv6  is  essential. 

The  Air  Force’s  computing  systems  and  associated  software  can  best 
be  described  as  a  “patchwork  quilt”  of  confusion,  creating  serious  sys¬ 
temic  vulnerabilities.  First,  not  every  major  command  (MAJCOM) 
uses  the  same  hardware  or  software.  The  result  is  a  hodgepodge  of 
systems  and  differing  standards  that  affects  not  only  supporting  and 
defending  these  disparate  systems  but  also  training  in  the  cyber  ca¬ 
reer  fields  (i.e.,  How  should  AETC  or  MAJCOMs  train  against  a  non¬ 
standard  piece  of  equipment?).  Second,  the  life-cycle  management  of 
our  systems  often  appears  to  be  an  afterthought  in  that  the  Air  Force 
does  not  contract  for  life-cycle  support.  With  myriad  systems,  the 
life-cycle  support  costs  are  significantly  increased.  To  make  matters 
worse,  the  personnel  responsible  for  protecting  Air  Force  systems  are 
geographically  dispersed.  These  issues  present  a  problem  because  the 
innumerable  variants  of  operating  systems  and  practices  make  it 
more  difficult  for  IT  professionals  to  protect  vital  systems  and  create 
unanticipated  weaknesses  and  vulnerabilities  in  system  interfaces. 
This  study  recommends  that  the  Air  Force  CIO  establish  and  develop 
enforcement  mechanisms  to  ensure  standard  Air  Force-wide  IT  con¬ 
figurations,  allowing  better  network  integration  and  fewer  base-specific 
failures  with  security/network  defense  tools.  Another  helpful  step 
would  be  to  bring  together  a  core  group  of  programmers  who  can 
disseminate  best  practices  throughout  the  Air  Force. 

Along  with  establishing  standard  IT  systems  and  hardware,  the  ac¬ 
quisition  community  also  needs  to  assure  a  baseline  level  of  quality  in 
the  implemented  software.  Toward  that  end,  the  Air  Force  should  de¬ 
vote  sufficient  resources  to  this  important  task  since  it  is  certainly 
preferable  to  the  hacking  of  weapon  systems  data  that  has  clearly  oc¬ 
curred  in  the  recent  past.48  Efforts  to  ensure  software  security  are  ex- 
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pensive,  but  the  Air  Force  can  take  steps  to  mitigate  the  cost.  This 
study  recommends  that  the  Air  Force  increasingly  rely  on  its  enlisted 
programmers  to  supply  the  talent  to  perform  many  software  assur¬ 
ance  activities.  Although  civilians  and  officers  can  perform  these 
functions  admirably,  they  are  often  considerably  more  expensive  to 
obtain  and  retain.  Second,  efforts  are  under  way  to  take  advantage  of 
a  change  in  regulations  that  allows  the  Air  Force  to  hold  vendors  fi¬ 
nancially  liable  for  inept  software  designs  and/or  coding  that  leaves 
systems  vulnerable.49  Any  revenue  arising  from  these  efforts  should 
be  directed  toward  addressing  the  specific  problem  the  vendor  cre¬ 
ated  and  then  enhancing  software  assurance  so  that  it  does  not  hap¬ 
pen  again.  Finally,  since  fixing  poor  programming  can  be  more  diffi¬ 
cult  and  costly  than  writing  it  properly  in  the  first  place,  the  DOD 
and  Air  Force  should  provide  adequate  incentives  for  secure  pro¬ 
gramming  that  far  exceeds  the  level  necessary  to  avoid  liability.50 

The  final  aspect  of  the  acquisition  problem  is  the  lack  of  cyber- 
qualified  acquisition  program  managers  and  the  reluctance  of  exist¬ 
ing  program  managers  to  grant  cyber  specialists  decision  authority 
over  programmatic  decisions.51  Observers  of  the  debacle  of  the  Expe¬ 
ditionary  Combat  Support  System  (ECSS)  attribute  parts  of  this  pro¬ 
gram’s  failure  to  the  lack  of  integration  of  cyber  experts  into  the  early 
stages  of  program  design.52  Procurement  programs  in  the  DOD  can¬ 
not  and  will  not  keep  up  with  cyber  development  cycles.  To  stay 
ahead  of  cyber,  the  Air  Force  needs  to  have  connections  with  indus¬ 
try — being  disconnected  from  Silicon  Valley  guarantees  obsoles¬ 
cence,  hampers  education,  and  limits  training.  Although  industry 
drives  innovation,  cyber-educated  acquisitions  personnel  are  impor¬ 
tant  because  they  can  supply  industry  with  set  specifications  for 
mathematically  provable  secure  hardware/software.  Every  Air  Force 
mission  requires  networked  connectivity  to  some  degree  or  another. 
Additionally,  every  weapon  system  depends  on  data  and  signals — 
both  internally  to  accomplish  its  own  mission  and  externally  to  connect 
and  work  with  the  rest  of  the  forces.  To  establish  a  secure  software/ 
hardware  environment  as  industry  builds  our  platforms,  the  Air 
Force  needs  62Es,  systems  engineers,  and  other  acquisition  personnel 
who  understand  the  intricacies  of  a  platform’s  reliance  on  cyber.  To 
assure  mission  success,  they  need  to  acquire  and  design  security  into 
key  cyber  components  of  the  cyber  terrain  on  which  a  platform  relies. 
Conceptualizing,  requiring  these  specifications  to  be  built  into  the 
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hardware/software,  and  holding  industry  responsible  will  increase 
the  cost  of  successfully  exploiting  Air  Force  systems  to  the  adversary 

Despite  the  addition  of  cyberspace  as  the  third  domain  in  which 
the  Air  Force  conducts  operations,  the  grooming  of  a  cyber-qualified 
acquisition  corps  has  largely  been  neglected.  Engineering,  science, 
and  technology  management  tracks  explicitly  call  for  a  relevant  de¬ 
gree  and  have  a  much  more  elaborate  development  plan,  but  the  same 
is  not  true  of  the  cyber  track.53  Although  an  IT  certification  track  is 
offered  through  Defense  Acquisition  University,  the  curriculum  has 
no  specialized  cyber  content.  In  fact,  only  one  course  dealing  specifi¬ 
cally  with  IT  acquisition  is  required  at  each  certification  level.  Fur¬ 
thermore,  a  technical  baccalaureate  degree  is  merely  mentioned  as 
preferred,  and  a  bachelor’s  degree  in  business  administration  quali¬ 
fies  as  a  “preferred”  degree.54  A  technical  cyber  track  should  be  devel¬ 
oped  to  allow  for  cultivation  of  highly  trained  acquisition  civilians 
and  officers.  Such  a  program  could  be  roughly  modeled  after  the  en¬ 
gineering  track,  which  offers  substantial  training  and  marries  profes¬ 
sionals’  technical  backgrounds  with  the  practicalities  of  the  defense 
acquisition  system. 

Within  cyber  acquisitions  are  the  2210  series  of  IT  professionals 
and  the  1101  series  of  acquisition/program  management  (PM)  pro¬ 
fessionals.  Both  series  require  courses  in  basic  systems  acquisition, 
information  systems,  and  software  acquisition  management — ac¬ 
counting  for  118  hours  of  instruction — but  then  the  courses  diverge. 
The  2210s  receive  training  on  technical  reviews  and  software  mea¬ 
surement  and  dive  deeply  into  information  systems  acquisition  and 
software  acquisition  management,  for  281  hours  of  total  instruction 
time.  The  program  managers  receive  training  in  systems  planning, 
engineering,  logistics,  financial  management,  cost  analysis,  earned 
value  management,  contracts,  and  research  and  development  (R&D) 
before  taking  four  in-depth  courses  dealing  with  program  manage¬ 
ment  tools.  Instructional  time  for  the  program  management  track 
totals  470  hours. 

Although  one  could  argue  that  the  program  manager  is  more  qual¬ 
ified  to  manage  the  program,  finding  cyber-qualified  1101s  is  prob¬ 
lematic.  The  2210s  have  a  distinct  advantage  in  specific  IT-related 
instruction.55  However,  a  ceiling  apparently  exists  in  IT/software- 
dominant  program  executive  officers  and  organizations  and  missed 
opportunities  for  a  sustainable  career  path  for  the  field.  Additionally, 
the  top  nonsupervisory  2210-series  professional  standard  core  per- 
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sonnel  document  is  for  a  GS-13  while  other  functional  areas  may  in¬ 
clude  up  to  a  GS-15.  Extending  the  structure  to  a  GS-15  opens  the 
door  to  additional  training  such  as  Cyber  400,  ensures  that  2210s  can 
compete  for  advancement,  and  demonstrates  once  again  a  commit¬ 
ment  to  a  viable  career  path  in  IT  program  management.56  Various 
options  can  improve  IT/software  acquisition,  including  utilization  of 
2210s  as  the  PM  with  support  from  an  1101.  Based  upon  what  they 
may  be  called  upon  to  do,  it  makes  sense  for  PMs  to  take  some  addi¬ 
tional  courses  in  information  systems  and  software  management.  The 
2210s  could  take  the  role  of  advising  and  assisting  the  acquisition 
team,  as  do  engineers  (discussed  above). 

National  Initiative  for  Cybersecurity  Education 

Both  the  “Comprehensive  National  Cybersecurity  Initiative”  and 
the  complementary  Department  of  Defense  Cyberspace  Workforce 
Strategy  identify  significant  cybersecurity  workforce  development 
gaps  in  the  nation’s  manpower  and  offer  pathways  to  resolve  some 
workforce  challenges.57  Specifically,  education  and  awareness  are 
identified  as  key  national  gaps.  The  DHS  became  the  lead  organization 
to  develop  strategies  for  workforce  planning,  professionalization,  re¬ 
cruitment,  and  retention  for  the  cybersecurity  field.58  These  strategies 
are  being  developed  across  the  nation  via  the  department’s  Workforce 
Development  Initiative  within  its  Science  and  Technology  Directorate, 
Office  of  University  Programs.59  Major  activities  under  this  initiative 
include  the  following:60 

•  Cybersecurity  Workforce  Planning  Diagnostic:  gives  organiza¬ 
tions  an  interactive  tool  to  help  them  make  informed  decisions 
about  cybersecurity  workforce  planning.61 

•  National  Recruitment  and  Retention  Strategy:  focuses  on  tactics 
and  strategies  to  acquire  cybersecurity  professionals  from  such 
groups  as  (1)  women  and  minorities,  (2)  veterans,  and  (3)  two- 
year  college  graduates. 

•  National  Cybersecurity  Workforce  Framework  (“the  Frame¬ 
work”):  identifies  gaps  and  deficiencies  in  both  the  size  and  ca¬ 
pability  of  the  cybersecurity  workforce.62 
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NICE  and  Air  Force  Cyberspace  Operators 

A  key  finding  of  this  study  is  that  management  of  human  capital 
for  Air  Force  cyberspace — including  recruitment,  training,  and  de¬ 
velopment — was  hampered  by  the  question  about  who  constitutes  a 
cyberspace  operator.  When  the  Air  Force’s  communications  career 
field  (personnel  with  the  33S  AFSC)  was  transitioned  into  the  17D 
AFSC  (now  17  series),  the  assumption  was  that  any  Airman  who 
touched  a  computer  was  automatically  a  cyberspace  warrior.  How¬ 
ever,  the  DOD  has  three  broad  categories  of  cyberspace  operations — 
offensive,  defensive,  and  information  networks  (see  fig.  1,  chap.  1) — 
each  requiring  individuals  with  different  KSAs.  Transitioning  a  group 
of  Airmen  from  a  single  AFSC  into  a  new  cyberspace  AFSC  will  not 
meet  the  DOD’s  needs  on  the  operational  cyberspace  floor;  that 
group  of  Airmen  simply  does  not  have  enough  diversity  in  KSAs  to 
carry  out  all  varying  cyberspace  operations. 

Identifying  cyberspace  operators  is  a  problem  not  only  within  mili¬ 
tary  ranks  but  also  among  the  federal  civilian  workforce.  The  lack  of 
a  harmonized  cybersecurity  civilian  workforce  was  unanimously 
voiced  during  research  interviews.  The  research  team  discovered  a 
trend  involving  the  conversion  of  positions  that  were  traditionally 
engineering  to  interdisciplinary  positions.  Previously  these  positions 
were  open  only  to  individuals  in  the  0854  (CE)  or  0855  (EE)  fields 
who  met  specific  qualification  standards  required  for  all  professional 
engineering  positions.63  Prior  to  the  conversion  from  engineering 
billets  to  interdisciplinary  billets,  personnel  were  required  to  have  a 
degree  in  professional  engineering  (i.e.,  bachelor  of  science  in  CE, 
EE,  etc.)  to  fill  one  of  these  positions.  However,  one  interviewee  noted 
that  because  certain  cyberspace  billets  were  converted  to  interdisci¬ 
plinary  ones,  he  was  able  to  fill  the  position  without  an  engineering 
degree.  The  individual  was  in  the  cybersecurity  position  because  the 
1550  career  field  (CS)  was  now  eligible  to  fill  what  had  previously 
been  limited  to  the  0854  and  0855  career  fields.64 

Because  federal  civilian  cyberspace  billets  are  in  transition,  confu¬ 
sion  exists  about  who  cyberspace  operators  are.  Currently,  many  fed¬ 
eral  civilian  personnel  who  are  actually  cyberspace  operators  have 
occupational  series  codes  not  considered  cyber  while  other  civilians 
who  are  not  really  cyberspace  operators  have  the  2210  (IT  manage¬ 
ment)  code.  Researchers  found  that  the  AFPC  could  not  reliably 
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identify  which  civilians  were  working  cyberspace  operations  and 
which  were  not,  even  when  the  operations  were  clearly  defined. 

Applying  the  NICE  Framework  to  the  Workforce 

To  help  resolve  the  confusion  about  who  makes  up  the  cyberspace 
workforce,  the  NICE  framework  provides  a  codified  structure  that 
identifies  specialty  areas  of  cybersecurity  professionals  (fig.  7).  It  es¬ 
tablishes  a  common  taxonomy  and  lexicon  that  organizes  cybersecu¬ 
rity  work  into  categories  and  specialty  areas,  along  with  the  KSAs  that 
cybersecurity  professionals  must  demonstrate  for  different  positions 
within  the  specialty  areas.65  The  framework  was  developed  and  vali¬ 
dated  by  teams  of  psychologists  and  subject  matter  experts  (SME) — 
many  of  whom  were  former  Air  Force  employees — from  government, 
private  industry,  critical  infrastructure,  academic,  and  nonprofit  or¬ 
ganizations.  Thirty-one  functional  work  specialties  within  the  cyber¬ 
security  field  are  outlined. 
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Figure  7.  NICE  framework.  (Adapted  from  NICE,  "National  Cybersecurity 
Workforce  Framework,"  March  2013,  http://csrc.nist.gov/nice/framework.) 

OPM  is  scheduled  to  mandate  NICE  for  the  civilian  workforce  by 
2017.  The  Air  Staff  Cyber  Career  Field  Management  Office  is  in  the 
process  of  mapping  military  cyberspace  positions  within  the  DOD 
to  the  NICE  framework,  which  supports  the  broader  objectives  of 
the  DOD  Cyberspace  Workforce  Strategy.  Since  the  NICE  frame¬ 
work  is  currently  in  electronic  form,  an  opportunity  exists  for  the 
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Office  of  the  Deputy  Chief  of  Staff  for  Personnel  (HAF/A1)  to  create 
an  electronic  personnel  tracking  mechanism  mapped  to  NICE. 
Such  a  mechanism  could  create  efficiencies  by  establishing  special 
experience  identifiers  (SEI)  to  classify  cyberspace  personnel  with 
unique  capabilities. 

An  additional  benefit  of  the  NICE  framework  is  that  it  seeks  to 
categorize  and  track  cyber  personnel  in  leadership,  management, 
training,  and  education.  This  tool  will  provide  direction  and  advocacy 
so  that  individuals  and  organizations  may  effectively  conduct  cyber¬ 
security  work  in  the  technical  fields.66  It  is  our  determination  that  the 
legal,  strategic,  and  policy  development  aspects  of  cyber  operations  are 
a  largely  overlooked  segment  of  the  cyber  workforce.  However,  the 
oversight  and  governance  of  cyber  operations  are  integral  to  opera¬ 
tionalizing  the  domain;  this  process  is  managed  by  personnel  includ¬ 
ing  legal  advisors  and  strategic  planners  as  well  as  educators  and 
trainers.  Currently,  the  bench  is  not  deep  with  individuals  who  truly 
understand  both  technology  and  policy.  As  one  senior  leader  at  US- 
CYBERCOM  informed  the  research  team,  this  scarcity  results  in  a 
lack  of  trust  to  operationalize  the  cyber  domain.  The  role  of  individu¬ 
als  in  the  oversight  and  governance  functions  of  the  NICE  framework 
is  to  craft  national  and  DOD  policies  and  interpret  OCO  and  DCO  in 
ways  that  will  enhance  the  utilization  of  cyberspace  as  an  aspect  of 
American  national  power.  Below  is  a  selection  of  US,  DOD,  and  Air 
Force  policies  that  shape  the  utilization  of  cyber  power. 

National  Policies 

Numerous  documents  articulate  US  national  and  cybersecurity 
policies: 

•  The  National  Security  Strategy  ( NSS )  articulates  the  US  presi¬ 
dent’s  vision  for  cybersecurity,  stating  that  the  nation  should 
“defend  [itself],  consistent  with  U.S.  and  international  law, 
against  cyber  attacks  and  impose  costs  on  malicious  cyber  ac¬ 
tors,  including  through  prosecution  of  illegal  cyber  activity.”67 

•  The  National  Strategy  to  Secure  Cyberspace  ( NSSC )  is  the  main 
strategy  document  regarding  the  US  government’s  priorities  and 
response  framework  for  cyberspace  threats.  It  codifies  earlier 
presidential  directives  and  laws  into  a  coherent  national  strategy.68 
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•  The  “Comprehensive  National  Cybersecurity  Initiative”  was  first 
created  in  January  2008  when  President  George  W.  Bush  signed 
classified  joint  Presidential  Directive  54  /  Homeland  Security 
Presidential  Directive  23. 69 

•  The  International  Strategy  for  Cyberspace  describes  how  the 
United  States  should  coordinate  its  efforts  to  promote  the  ideals 
of  openness,  security,  and  prosperity  on  the  Internet.70 

•  The  Administration  Strategy  for  Mitigating  the  Theft  of  U.S.  Trade 
Secrets  includes  US  government  responses  to  intellectual  prop¬ 
erty  theft  in  the  commercial  sector.71 

•  The  Cyberspace  Policy  Review  was  directed  by  President  Barack 
Obama  to  evaluate  US  cybersecurity  structures  and  policies.72 

•  Executive  Order  (EO)  13636,  Improving  Critical  Infrastructure 
Cybersecurity,  was  “designed  to  increase  the  level  of  core  capa¬ 
bilities  for  our  critical  infrastructure  to  manage  cyber  risk  ...  by 
focusing  on  three  key  areas:  (1)  information  sharing,  (2)  privacy, 
and  (3)  the  adoption  of  cybersecurity  practices.”73 

DOD  and  Air  Force  Policies 

Specific  policies  also  guide  cyberspace  operations  within  the  DOD: 

•  National  Military  Strategy  for  Cyberspace  Operations  ( NMS-CO)7i 

•  Department  of  Defense  Strategy  for  Operating  in  Cyberspace75 

•  JP  3-12  (R),  Cyberspace  Operations,  5  February  2013 

•  Curtis  E.  LeMay  Center  for  Doctrine  Development  and  Education, 
Annex  3-12,  Cyberspace  Operations,  30  November  2011,  https:// 
doctrine.  af.mil/download.jsp?filename=3- 12- Annex-CYBER 
SPACE-OPS.pdf 

•  Air  Force  Policy  Directive  10-17,  Cyberspace  Operations,  31  July 
2012 

In  addition  to  such  policies,  existing  international  legal  frame¬ 
works  clarify  how  law  and  policy  should  treat  specific  instances  of  the 
use  of  force  and  cyber  attacks  in  warfare.  The  Tallinn  Manual  on  the 
International  Law  Applicable  to  Cyber  Warfare — perhaps  the  most 
comprehensive  work  on  the  issue  to  date — defines  cyber  attack  as  a 
“cyber  operation,  whether  offensive  or  defensive,  that  is  reasonably 
expected  to  cause  injury  or  death  to  persons  or  damage  or  destruc- 
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tion  to  objects.”  Further,  “a  cyber  operation  constitutes  a  use  of  force 
when  its  scale  and  effects  are  comparable  to  non-cyber  operations 
rising  to  the  level  of  a  use  of  force.”76  These  definitions  are  parsimoni¬ 
ous  and  allow  for  a  clearer  interpretation  of  actions  in  cyberspace. 
Furthermore,  the  only  systems  they  apply  to  are  ICSs  and  other  OTs 
as  described  above. 

However,  US  law  has  broader  definitions  for  cyberspace  opera¬ 
tions  that  apply  to  a  much  larger  range  of  systems.  Different  sections 
of  the  US  Code  necessitate  distinct  responses  to  acts  of  cyber  espio¬ 
nage,  cybercrime,  and  cyber  attack.  Clear  definitions  for  these  vari¬ 
ous  acts  of  cyber  aggression  are  therefore  required.  Additionally,  the 
intended  targets  and  potential  effects  of  such  acts  must  also  be  under¬ 
stood.  Such  acts  of  cyberspace  aggression  include  not  only  individu¬ 
als  doing  something  illegal  and  crime  syndicates  carrying  out  a  more 
sophisticated  attack  but  also  nation-states  spying  on  or  actually  car¬ 
rying  out  offensive  cyberspace  operations  against  other  nations.  To 
distinguish  between  organized  crime  and  armed  attacks  in  cyber¬ 
space,  the  research  team  adopted  the  following  definitions  of  cyber 
espionage,  cybercrime,  cyber  disruption,  and  cyber  attack: 

•  Cyber  espionage:  The  act  of  securing  information  of  a  military  or 
political  nature  that  a  competing  nation  holds  secret.77 

•  Cybercrime:  Any  interference  with  the  functioning  of  a  com¬ 
puter  system,  with  the  fraudulent  or  dishonest  intent  of  procur¬ 
ing,  without  right,  an  economic  benefit  for  oneself  or  another 
person.78 

•  Cyber  disruption:  The  serious  hindering,  without  right,  of  the 
functioning  of  a  computer  system  by  inputting,  transmitting, 
damaging,  deleting,  deteriorating,  altering,  or  suppressing  com¬ 
puter  data.79 

•  Cyber  attack:  “[A]  cyber  operation,  whether  offensive  or  defen¬ 
sive,  that  is  reasonably  expected  to  cause  injury  or  death  to  per¬ 
sons  or  damage  or  destruction  to  objects.”80 

The  paradigms  required  to  address  cybercrime  and  cyber  espionage 
are  not  the  same  as  those  needed  to  succeed  in  cyberspace  warfare. 
Understanding  the  distinctions  among  the  various  types  of  malicious 
cyberspace  activity  helps  policy  makers  decide  whether  to  adopt  ex¬ 
isting  international  law  or  develop  global  norms.  Such  decisions — 
critical  to  ensuring  stability  in  cyberspace — cannot  be  judiciously 
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made  without  a  workforce  possessing  the  technical  aptitude  to  apply 
knowledge  of  priorities  or  appropriately  provide  legally  sound  advice. 
Currently,  this  situation  is  not  the  case.  For  example,  the  persistent 
confusion  between  IT  and  OT  results  in  the  misperception  that  all 
OCOs  can  result  in  effects  and  unintended  consequences  if  the  target 
is  on  an  open  network  or  on  closed  critical  infrastructure  networks. 
Centralization  of  specific  attacks  against  certain  targets  might  be  nec¬ 
essary  in  these  sorts  of  missions. 

However,  even  if  prescripted  concepts  of  operations  are  authorized 
for  use,  the  dynamic  environment  of  cyberspace  and  current  com¬ 
mand  and  control  structures  do  not  allow  for  flexible  responses  to 
changing  network  topologies.  A  cyber  warrior  carrying  out  a  mission 
set  authorized  by  USCYBERCOM  might  have  to  stop  the  attack  with¬ 
out  completing  the  objective  because  the  adversary  has  updated  his 
computer  system  with  the  latest  vulnerability  patch,  thereby  not  al¬ 
lowing  the  cyber  operator  to  continue  with  the  preapproved  route. 
Having  to  go  back  up  the  chain  of  command  to  receive  authorization 
to  continue  with  a  new  attack  vector  could  have  negative  effects  on 
kinetic  missions  that  rely  on  exploitation  of  the  adversary’s  informa¬ 
tion  system.  Cyber  judge  advocate  generals  (JAG)  and  strategic  pol¬ 
icy  makers  with  a  keen  sense  for  the  technology  could  craft  guidance 
allowing  for  a  cyber  operators  flexible  response  to  actively  engage 
with  changing  network  topologies  and  achieve  the  desired  effect 
without  losing  operational  advantage.  Thus,  we  recommend  mapping 
the  KSAs  of  cyber  JAGs  and  strategic  planners  to  the  NICE  frame¬ 
work  and  using  SEIs.  Doing  so  will  begin  to  establish  a  workforce  of 
social  and  behavioral  scientists  who  have  demonstrated  a  technical 
aptitude  beyond  that  reflected  in  introductory  courses.  Such  a  cadre 
would  have  more  of  the  requisite  skills  to  exercise  strategic  policy  and 
provide  legal  guidance  about  cyber  operations. 

Summary 

General  Welsh  states  that  “the  Air  Force  provides  critical  capabilities 
that  enhance  the  military’s  capacity  to  navigate  accurately,  observe 
clearly,  communicate  securely,  and  strike  precisely.”81  Cyberspace  is 
no  less  important  than  physical  assets  in  fighting  a  potential  peer  com¬ 
petitor.  America’s  technologically  advanced  systems  in  command  and 
control,  communications,  targeting,  and  battlespace  awareness  pro¬ 
vide  an  unrivalled  advantage  that  depends  heavily  on  cyberspace  and 
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cyberspace  assets  in  space.  Past  and  present  reliance  on  cyberspace 
capabilities  during  operational  conflicts  leaves  little  doubt  about  its 
growing  importance.  To  protect  Americas  vital  interests  in  cyber¬ 
space  during  the  coming  decades,  the  Air  Force  must  begin  thinking 
through  the  impact  of  cyber  to  the  mission  within  the  technology 
and  policy  contexts  outlined  in  this  chapter. 

We  make  the  following  recommendations  based  on  the  preceding 
discussion: 


Recommendations  Summary 


•  Manpower  planners  must  account  for  the  JIE  and  other  systemic  tech¬ 
nological  paradigm  shifts  as  they  assess  their  5-to-1 0-year  workforce 
requirements. 

•  The  DOD  and  USAF  should  document  their  roles  and  provide  metrics  on 
their  participation  and  position  with  Internet  governance  bodies. 

•  The  USAF  CIO  should  develop  and  establish  enforcement  mechanisms 
to  ensure  standard  Air  Force-wide  IT  configurations,  allowing  better  net¬ 
work  integration  and  fewer  base-specific  failures  with  security/network 
defense  tools. 

•  The  USAF  should  embed  the  life-cycle-management  process  as  part  of  its 
cyber  decision  making. 

•  The  USAF  should  increasingly  rely  on  its  enlisted  programmers  to  supply 
the  talent  to  perform  many  software  assurance  activities.  Although  civil¬ 
ians  and  officers  can  perform  these  functions  admirably,  they  are  often 
considerably  more  expensive  to  obtain  and  retain. 

•  The  DOD  and  Air  Force  should  provide  adequate  incentives  for  secure 
programming  that  far  exceeds  the  level  necessary  to  avoid  liability. 

•  The  USAF  should  examine  holding  vendors  financially  liable  for  inept 
software  design  and/or  coding  that  leaves  systems  vulnerable. 

•  Incorporate  the  DHS's  NICE  framework  across  cyberspace  career  fields. 

•  Create  electronic  professional  development  tracking  mechanisms  (such  as 
SEIs)  mapped  to  NICE. 

•  Recognize  cyberspace  as  a  domain  with  language  and  social  science  re¬ 
quirements,  and  catalog  personnel. 

•  Mandate  a  firm  transition  date  to  IPv6  utilizing  DOD  acquisition  policies 
and  the  JIE. 

•  The  USAF  needs  to  ensure  that  adequate  training  exists  on  cyberspace 
ranges  within  IPv6  environments  for  cyberspace  operators.  All  current  op¬ 
erators  need  to  be  proficient  in  IPv6  now. 
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Recommendations  Summary  ( continued ) 


•  The  DOD,  particularly  the  USAF,  should  take  a  more  active  role  in  the  de¬ 
velopment  of  the  cyberspace  infrastructure  and  the  standards  and  norms 
of  Internet  governance  mirroring  its  actions  in  the  domain  of  space  at 
ITU-Radiocommunications. 

•  The  USAF  should  develop  and  implement  proprietary  protocols  designed 
to  be  mathematically  secure. 

•  Broadband  mobility  provides  opportunities  to  engage  with  target  audi¬ 
ences;  social  scientists  and  linguists  will  be  critical  to  do  so  effectively. 
The  USAF  needs  to  ensure  that  it  has  an  adequate  number  of  linguists  and 
social  scientists  educated  /  trained  /  experienced  in  cyberspace  operations. 

•  Develop  formal  partnerships  between  the  engineering  communities, 
which  understand  operational  IT,  and  the  cybersecurity  communities, 
which  understand  network  IT,  to  mitigate  vulnerabilities  and  manage  risk 
to  critical  infrastructure. 

•  Bring  together  a  core  group  of  programmers  who  can  disseminate  best 
practices  throughout  the  Air  Force. 

•  Ensure  that  a  baseline  level  of  quality  is  achieved  in  the  implemented  soft¬ 
ware.  Toward  that  end,  the  Air  Force  should  devote  sufficient  resources  to 
this  important  task  since  doing  so  is  certainly  preferable  to  continuation 
of  the  recent  hacking  of  weapon  systems  data. 

•  Big-data  analytics  will  require  greater  emphasis  in  the  future,  and  the 
USAF  and  DOD  will  need  to  be  able  to  recruit,  train,  and  track  analysts 
capable  of  manipulating  big-data  sets.  Examine  the  need  for  big-data  ana¬ 
lysts,  establish  formal  requirements  to  address  these  needs,  and  work  to 
establish  a  mechanism  to  identify  and  track  expertise. 

•  Cultivate  a  culture  of  understanding  the  differences  between  IT  and  OT 
to  serve  as  a  foundation  for  discussion  of  the  cyber  dependencies  of  core 
Air  Force  missions. 
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Chapter  3 

Recruit,  Retain,  Regain 

How  the  Air  Force  recruits  and  selects  individuals  for  cyber  educa¬ 
tion  and  training  is  a  key  challenge  to  developing  a  cyber  workforce 
that  operationalizes  the  domain.  One  of  the  questions  this  study 
sought  to  answer  was,  What  makes  a  good  hacker?  Do  you  start  with 
a  rocket  scientist,  a  computer  expert,  or  a  Sherlock  Holmes  type  of 
person?  We  discovered  that  identifying  the  attributes  of  a  top-notch 
cyber  operator  is  part  of  the  problem.  IT  proficiency  does  not  neces¬ 
sarily  translate  into  having  an  aptitude  or  a  proclivity  for  being  an 
offensive  or  a  defensive  cyber  operator.  Thus,  to  operationalize  the 
domain  with  personnel  ready  to  defend  Air  Force  missions  and  to 
serve  on  the  Cyber  Mission  Force  (CMF)  and  cyber  protection  teams 
(CPT),  the  USAF  should  focus  on  recruiting  individuals  who  can 
operate  in  the  OCO/DCO  mission  space  and  have  DODIN  experi¬ 
ence  versus  those  with  solely  DODIN  experience. 

Broadly,  cyber  operators  are  thought  of  as  those  who  touch  any 
aspect  of  any  network.  Such  generalities  have  created  misperceptions 
in  the  “what’s  in/out  of  cyberspace”  discussion.  More  rigorous  per¬ 
sonnel  requirements  are  useful.  To  an  extent,  this  need  has  been  re¬ 
solved  by  creating  the  distinction  between  the  DODIN  and  OCO/ 
DCO.  DODIN  operators  perform  the  critical  functions  of  maintain¬ 
ing  and  sustaining  the  network  provided  to  war  fighters — often 
equated  with  hacking  but  in  actuality  involving  building  and  sustain¬ 
ing  networks.  The  Air  Force  information  network  function  lies  within 
A6,  which  has  experience  in  and  a  tradition  of  attracting  and  devel¬ 
oping  this  breed  of  cyber  operator.  OCO  and  DCO  require  skill  sets 
from  the  intelligence,  operations,  and  communications  career  fields 
to  operationalize  cyberspace  and  thus  create  effects  that  will  protect 
and  defend  US  national  security  interests,  giving  the  president  sover¬ 
eign  options  to  project  US  power. 

Recruiting  talent  and  retaining  our  investment  in  cyber  operators 
in  the  OCO/DCO  communities  are  key  issues  examined  next.  We 
also  discuss  the  potential  for  regaining  individuals  who  separated 
from  service  to  practice  cyber  operations  in  the  private  sector  but 
who  may  want  to  return  to  government  service  to  apply  lessons 
learned  in  industry  to  USAF  missions. 
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Recruit 

The  key  to  force  structure  is  to  find  educated  people  with  a  proclivity 
toward  hacking.  The  recruitment  pool  is  not  as  bleak  as  many  portray 
it.  A  National  Society  of  High  School  Scholars  study  on  The  Emerging 
Workforce:  Generational  Trends  states  that  the  Air  Force  places  18th 
out  of  200  nationwide  places  to  work.2  It  also  notes  that  among  mil- 
lennials,  the  top  career  interests  “are  STEM  [science,  technology,  en¬ 
gineering,  and  mathematics]  fields,  particularly  medical,  business 
and  government.  As  for  what  they  hope  to  find  in  the  workplace,  they 
ranked  fair  treatment,  corporate  social  responsibility,  and  benefits 
the  highest.”3 

However,  the  fact  that  individuals  are  interested  in  STEM  does  not 
mean  that  they  will  be  good  cyber  operators.  As  the  USAF’s  Cyber 
Vision  2025  notes,  “Some  individuals  have  proven  cyber  aptitude 
without  a  technical  degree,  but  these  are  the  exception.  .  .  .  The  Air 
Force  needs  an  aptitude  test  to  assess  and  admit  only  those  non-cyber 
educated  individuals  who  demonstrate  both  interest  and  aptitude.”4 
Understanding  what  makes  a  great  DCO/OCO  operator  is  thus  part 
of  the  challenge  that  the  Air  Force  is  currently  working  to  resolve. 

Individuals  selected  to  protect  US  national  security  in  the  cyber 
arena  must  share  some  common  traits.  Expert  interviews  indicated 
that  good  hackers  are  autodidactic,  able  to  work  well  on  teams  to 
solve  problems  in  novel  ways,  and  have  critical  thinking  skills.  Fur¬ 
ther,  besides  having  technical  aptitude,  cyber  recruits  must  be  a  good 
fit  for  the  Air  Force  culture  of  integrity,  service,  and  excellence.  Will¬ 
ingness  to  work  as  part  of  a  team  versus  maintaining  a  self-focused 
orientation — another  important  criterion — is  generally  not  a  prob¬ 
lem  for  the  Air  Force  since  all  levels  of  its  education  and  training 
emphasize  teamwork. 

Equating  technical  aptitude  as  a  measure  of  cyber  operations  po¬ 
tential  in  a  recruit  is  problematic.  As  this  study  found,  a  perception 
exists  that  using  a  computer  equates  to  knowing  how  it  works.  This 
view  stems  from  generational  differences  resulting  from  the  evolu¬ 
tion  of  personal  computing  and  networking  from  the  1980s  to  the 
present.  While  Generation  Xers  and  early  millennials  grew  up  in  the 
nascent  days  of  computer  networks — an  era  when  experimentation 
and  exploration  on  desktop/laptop  computing  platforms  and  net¬ 
works  were  encouraged — today  things  are  different.  The  convergence 
of  broadband  and  mobile  technologies  has  created  push-button  “app” 
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ecosystems  such  as  the  iPhone  Operating  System  (iOS)  that  do  not 
leave  a  user  much  interface  to  interact  with  underlying  hardware  and 
software.  As  a  result,  although  millennials  in  the  latter  half  of  their 
generational  spectrum  who  have  grown  up  with  this  technology  para¬ 
digm  may  not  understand  how  their  platforms  function,  they  dem¬ 
onstrate  to  previous  generations  that  they  are  technologically  savvy 
because  of  their  aptitude  for  using  applications.5  Cyber  career  field 
managers  anecdotally  noted  that  some  recruits  had  poor  keyboard 
skills  due  to  their  use  of  mobile  technology  rather  than  desktop  com¬ 
puters.6  Thus,  much  like  operating  a  car,  the  ability  to  use  a  comput¬ 
ing  device  does  not  necessarily  denote  an  understanding  of  how  it 
works  or  having  the  skill  to  repair  it  or  improve  its  performance. 

Placing  too  much  value  on  educational  background  could  create  a 
barrier  to  entry  in  the  cyber  operations  field  that  will  exclude  those 
with  latent  aptitude,  thereby  depleting  the  recruitment  pool  from 
which  operators  are  drawn.  Put  another  way,  individuals  who  have 
the  potential  to  be  talented  cyber  operators  might  possess  neither  a 
formal  education  nor  the  requisite  industry- standard  certificates.  Dis¬ 
covering  bright  candidates  who  underachieved  in  high  school/college 
is  important.  Some  (not  all)  operators’  backgrounds  are  not  standard. 
They  may  come  from  the  hacker  communities  or  lack  the  financial  or 
time  resources  to  invest  in  a  cyber  certification  program.  Since  the 
field  is  undermanned,  entirely  eliminating  these  people  from  the 
pool  is  counterproductive  from  an  overall  manning  standpoint.  Test¬ 
ing  for  cyberspace  operations  aptitude  is  one  method  that  could  as¬ 
sist  in  identifying  such  individuals  during  the  recruitment  process. 

Measuring  a  prospective  recruit’s  knowledge  of  basic  computer 
and  networking  concepts  is  a  good  starting  point  to  identify  those 
with  a  potential  aptitude  for  cyber  operations.  The  711th  Human  Per¬ 
formance  Wing  developed  and  the  Air  Force  has  instituted  such  a 
tool  to  test  for  these  indicators  of  success.  As  awareness  of  the  need 
for  high-quality  offensive  and  defensive  cyber  capabilities  has  grown, 
the  Air  Force,  Navy,  and  Army  have  all  looked  for  a  way  to  augment 
the  Armed  Services  Vocational  Aptitude  Battery  (ASVAB)  test  for 
classifying  new  enlisted  personnel  in  these  military  occupations.  This 
“cyber  test”  emphasizes  four  content  areas:  (1)  networking  and  com¬ 
munications,  (2)  computer  operations,  (3)  security  compliance,  and 
(4)  software  programming  and  Web  development.  In  2007  develop¬ 
ment  efforts  resulted  in  a  test  for  cyber  classification.  The  cyber  test  has 
now  been  launched  and  is  currently  in  operational  use  (fiscal  year 


54  |  RECRUIT,  RETAIN,  REGAIN 


[FY]  2014).  Because  of  the  continuously  changing  nature  of  the  field, 
the  test  will  need  regular  updating  by  a  dedicated  staff. 

Analyses  of  test  performance  results  indicated  that  the  cyber  test 
scores  can  increase  the  size  of  the  qualified  applicant  pool  without 
increasing  school  attrition.7  An  optimal  percentile  cut  score  of  60  was 
established  for  the  target  cyber  and  intelligence  Air  Force  specialties. 
For  example,  enlisted  applicants  maybe  classified  into  AFSC  3D0X1, 
Knowledge  Operations  Management,  with  an  ASVAB  general  com¬ 
posite  score  of  64  or  one  between  54  and  63  together  with  a  cyber  test 
score  of  60.8  This  particular  classification  strategy  increases  the  num¬ 
ber  of  qualified  individuals  in  the  applicant  pool  while  maintaining 
the  same  level  of  school  performance;  moreover,  it  can  increase  di¬ 
versity  numbers.  Therefore,  the  cyber  test  can  identify  qualified  ap¬ 
plicants  among  those  marginally  below  the  current  ASVAB  electronic 
and  general  classification  composite  cut  scores  in  Air  Force  cyber  and 
intelligence  specialties. 

Other  strategies  could  decrease  the  size  of  the  qualified  applicant 
pool  while  increasing  school  performance  and  graduation  rates  (and 
presumably  field  performance  and  retention) — for  example,  main¬ 
taining  minimum  cut  scores  on  electronic/general  composites  and 
rank-ordering  qualified  applicants  by  cyber  scores.  Ideally,  the  entry- 
level  cyber  classification  test  will  become  part  of  the  ASVAB  (not  just 
a  special  test),  and  optimum  composites  can  be  developed  by  the 
team  at  AFPC.  Currently,  all  USAF  applicants  take  the  cyber  test  at 
the  Military  Entrance  Processing  Station,  partly  for  research  data  on 
experimental  items  seeded  within  the  current  test,  so  the  move  from 
“special  test”  status  to  ASVAB  subtest  will  have  minimal  impact  on 
testing  time. 

The  cyber  test  will  go  a  long  way  toward  identifying  personnel 
with  a  knowledge  base  in  computer  sciences,  but  it  does  not  measure 
a  specific  aptitude  for  OCO/DCO.  The  Air  Force  is  currently  partici¬ 
pating  in  a  joint  effort  with  the  Army  to  develop  just  such  a  test — one 
that  contains  50  questions  (25  on  skills  and  25  on  aptitude).  It  was 
field-tested  for  seven  months,  concluding  in  January  2015.  Once  the 
testing  data  is  collected,  it  will  be  compared  with  the  Air  Force  Offi¬ 
cer  Qualifying  Test  (AFOQT)  and  ASVAB  scores  to  see  what,  if  any, 
correlations  can  be  used  as  potential  indicators  of  an  aptitude  for 
OCO/DCO.  If  the  results  are  predictable,  the  cyber  test  will  be  evalu¬ 
ated  for  addition  to  the  AFOQT  and  ASVAB.9 
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In  addition  to  screening  potential  recruits,  this  study  also  deter¬ 
mined  that  latent  cyber  operators  may  be  found  in  other  Air  Force 
career  fields.  The  USAF  should  therefore  examine  ways  to  give  op¬ 
portunities  to  Airmen  in  these  other  fields  to  transfer  into  the  cyber¬ 
space  warfare  and  network  operations  officer  (17  series,  or  17S),  en¬ 
listed  cyberspace  defensive  operations  (1B4  series),  cyberspace 
support  (3D  series),  or  cyber-related  civilian  career  fields  (see  chap. 
5,  “Force  Development,”  for  detailed  information  on  these  fields).  The 
cyber  test  could  be  one  way  to  allow  Airmen  from  other  AFSCs  who 
have  an  interest  in  cyber  or  have  CS,  CE,  or  EE  degrees  to  demon¬ 
strate  their  aptitude  to  be  cyber  warriors. 

Proper  accessions  will  require  more  targeted  recruiting  and  train¬ 
ing.  Models  that  predict  cyber  success  are  useful  in  selecting  people 
for  cyber  training  and  potentially  reducing  washout  rates. 

Quantity  of  Recruits  versus  Quality  of  Education 

Throughout  the  course  of  the  study,  research  team  members  de¬ 
bated  about  the  percentage  of  STEM  versus  non-STEM  personnel 
needed  within  the  Air  Force.  Although  Air  Staff  cyber  career  develop¬ 
ment  managers  have  mandated  the  requirements,  discussion  contin¬ 
ued  on  the  right  balance  among  education,  experience,  and  aptitude. 

Part  of  the  reason  for  the  existence  of  the  training  versus  education 
debate  stems  from  persistent  myths  that  the  cost  of  entry  into  cyber 
operations  is  low.  Some  people  have  the  perception  that  relatively  un¬ 
sophisticated  nonstate  actors  (such  as  the  proverbial  teenager  in  his 
or  her  parents’  basement)  could  cause  incidents  of  national  signifi¬ 
cance  in  the  cyber  arena.  It  is  true  that  novices  might  successfully 
conduct  criminal  activity  and  disruptive  denial-of-service  attacks.10 
However,  this  concept  is  a  myth  when  one  considers  the  defense  of 
national  security  missions  against  nation-state  adversaries  that  the 
Air  Force  would  care  about.  Industrial  control  systems,  embedded 
processors  and  controllers,  and  other  IT  integrated  into  platforms  re¬ 
quire  a  different  skill  set  than  that  of  a  proficient  network  hacker.11 
Those  with  master’s  and  doctorate  degrees  are  generally  much  better 
at  conducting  cyber  warfare  due  to  the  theoretical  and  practical  focus 
of  education.  Formal  education  shapes  the  minds  of  individuals  with 
technical  aptitude  in  a  way  that  allows  them  to  apply  their  knowledge 
of  cyberspace  to  research,  design,  develop,  test,  and  evaluate  hardware, 
software,  and  firmware  for  the  purpose  of  exploiting,  defending,  and 
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attacking  cyber  and  cyber  physical  systems.  We  need  not  look  far  to 
find  a  historical  model  for  the  cyber  workforce  that  mandated  ad¬ 
vanced  technical  knowledge  as  a  part  of  a  certain  career  path.  Ini¬ 
tially,  becoming  a  pilot  in  the  Air  Force  required  an  engineering  and 
science  background.  Eventually,  we  were  able  to  move  away  from  this 
requirement  as  we  got  the  “science”  right  over  years  of  learning.  If  we 
really  are  at  the  “Wright  Flyer”  stage  of  cyber,  then  the  Air  Force 
should  utilize  commissioning  sources  to  shape  the  makeup  of  the  cy¬ 
ber  operations  career  field. 

A  sticking  point  was  the  benefits  of  formal  education  versus  train¬ 
ing.  Essentially,  if  the  best  tools  are  available  but  the  individuals  using 
them  have  knowledge  based  on  rote  memorization  to  pass  industry- 
standard  certification,  they  may  only  be  able  to  follow  a  checklist. 
Thus,  advanced  tools  might  not  be  used  to  their  potential.  Alterna¬ 
tively,  if  individuals  are  educated  in  the  science  and  theory  of  cyber 
operations,  then  even  with  average  tools  they  can  make  exceptional 
things  happen.  As  some  experts  observe,  “Training  without  education 
proved  insufficient  to  assure  mathematically  complex,  information 
centric  systems.  In  a  world  where  our  peers  educate  their  cyber  opera¬ 
tors  first  on  the  science  of  information  assurance,  then  train  them  in 
the  art  of  cyber  warfare,  our  cyber  workforce  development  continues 
to  shun  specialized  education  in  favor  of  generalized  training — a  too- 
little-too  late  process  with  an  established  record  of  inadequacy  for 
national  security  missions.”12  The  research  team  agrees  that  education 
is  key  and  thus  strongly  recommends  that  the  USAF  recruit  cyber- 
educated  Airmen  from  the  1B4,  1NX,  and  3D  career  fields.  Further, 
in  lean  years  for  tuition  assistance,  Airmen  in  these  career  fields 
should  be  prioritized  to  receive  financial  assistance  toward  their  edu¬ 
cation  in  STEM  fields. 

Another  potential  option  for  obtaining  the  desired  educated  ac¬ 
cessions  candidates  is  through  payment  of  bonuses  to  those  with  the 
requisite  background  and  education.  Title  37,  section  324,  of  the  US 
Code  outlines  the  authority  for  the  secretary  of  the  Air  Force  (SECAF) 
to  pay  an  accession  bonus.  The  SECAF  is  authorized  to  pay  individual 
recruits  up  to  $60K  (although  the  bonus  is  usually  lower),  which  can 
be  paid  in  a  lump  sum  but  is  typically  paid  in  four  annual  install¬ 
ments.  For  the  13N  (nuclear  and  missile  operations)  career  field,  for 
instance,  the  USAF  proposed  an  accession  bonus  of  $24K  paid  in 
three  annual  installments  of  $8K.  With  the  SECAF  currently  in  favor 
of  an  accession  bonus  for  13Ns,  there  is  the  possibility  of  using  an  ac- 
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cession  bonus  in  the  17S  career  field  as  well.13  Although  the  research 
team  did  see  the  possibilities  of  this  option,  it  found  that  recruiting 
candidates  by  means  of  this  method  was  more  difficult  than  through 
the  Reserve  Officer  Training  Corps  (ROTC).14 

Cyber  Criminality  and  the  Security  Clearance  Challenge 

Moral  attributes  also  contribute  to  identifying  the  right  people  to 
protect  US  national  security  The  Air  Force  culture  is  often  seen  as  the 
antithesis  of  the  hacker  culture  in  which  innovative  potential  cyber 
operators  thrive.  The  specialized  nature  of  cyber  operations  for  na¬ 
tional  security  purposes  requires  the  recruitment  of  individuals  who 
live  according  to  the  Air  Force’s  core  values  and  can  obtain  and  main¬ 
tain  a  Top  Secret  (TS)/sensitive  compartmented  information  (SCI) 
security  clearance.  According  to  the  Curtis  E.  LeMay  Center  for  Doc¬ 
trine  Development  and  Education,  core  values  “are  a  statement  of 
those  institutional  values  and  principles  of  conduct  that  provide  the 
moral  framework  within  which  military  activities  take  place.  The  pro¬ 
fessional  Air  Force  ethic  consists  of  three  fundamental  and  enduring 
values  of  integrity,  service,  and  excellence.”15  As  the  Air  Force  seeks  to 
boost  the  numbers  in  its  cyber  workforce,  both  military  and  civilian, 
this  study  urges  caution  in  recruitment.  Appropriate  screening  prac¬ 
tices  can  help  eliminate  persons  who  might  have  a  skewed  moral  com¬ 
pass  and  thus  mitigate  severe  insider  threats  posed  by  individuals  such 
as  Chelsea  (nee  Bradley)  Manning  or  Edward  Snowden.16 

The  Air  Force  should  not  be  expected  to  forgo  its  core  values  to 
bring  in  the  “best  and  brightest”  hacker  stereotypes.  However,  the  age 
cohort  from  which  we  are  recruiting  the  next  Air  Force  cyber  opera¬ 
tors  is  being  diluted  due  to  cyber-criminal  activity.  Throughout  our 
research,  anecdotal  stories  persisted  of  some  talented  youths  being 
unrecruitable  due  to  crimes  they  committed  under  the  Computer 
Fraud  and  Abuse  Act  and  US  Patriot  Act  or  because  they  could  not 
pass  a  polygraph  test  and  NSA  security  screening  required  to  operate 
on  CMF  teams.  As  depicted  in  figure  8,  the  correlation  of  four  studies 
on  cyber-criminal  prosecutions  indicates  that  the  percentage  of  the 
populace  indicted  for  criminal  activity  in  cyberspace  is  highest  in 
those  ages  that  the  USAF  targets  for  recruitment.  One  could  argue 
that  by  ignoring  those  with  a  criminal  record,  the  Air  Force  would 
limit  itself  to  a  talent  pool  already  sought  after  by  corporations,  orga¬ 
nized  criminal  networks,  and  ad  hoc  hacker  collectives  competing 
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for  the  hearts  and  minds  of  talented  youth.  This  notion,  however,  re¬ 
lies  on  past  paradigms  of  what  it  took  to  be  a  hacker. 


Figure  8.  Age  groups  of  cybercrime  perpetrators.  (Reproduced  from 
United  Nations  Office  on  Drugs  and  Crime  [UNODC],  "Comprehensive 
Study  on  Cybercrime,"  draft,  New  York:  United  Nations,  February  2013, 41.) 

aRaoul  Chiesa,  Stefania  Ducci,  and  Silvio  Ciappi,  Profiling  Hackers:  The  Science  of  Criminal 
Profiling  as  Applied  to  the  World  of  Hacking  (Boca  Raton,  FL:  CRC  Press),  2009. 
bXingan  Li,  “The  Criminal  Phenomenon  on  the  Internet:  Hallmarks  of  Criminals  and  Victims 
Revisited  through  Typical  Cases  Prosecuted,”  University  of  Ottawa  Law  and  Technology  Journal 
5,  nos.  1-2  (2008):  125-40. 

cChiChao  Lu,  Wen  Yuan  Jen,  Weiping  Chang,  and  Shihchieh  Chou,  “Cybercrime  and  Cyber- 
criminals,”  Journal  of  Computers  1,  no.  6  (September  2006):  11-18. 

dMichael  R.  McGuire,  John  Grieve  Centre  for  Policing  and  Security,  London  Metropolitan  Uni¬ 
versity,  Organised  Crime  in  the  Digital  Age  (London:  BAE  Systems  Detica),  March  2012. 


Discussions  with  the  hacker  community  revealed  that  two  hacker 
types  exist:  inquisitive  and  destructive.  Inquisitive  hackers  knowingly 
or  unknowingly  commit  computer  crimes  because  they  are  curious  but 
have  no  malicious  intent.  Destructive  hackers  commit  crimes  because 
of  their  criminal  tendencies.  Over  the  past  30  years,  inquisitive  hackers 
had  no  cost-effective  way  to  explore  cyberspace  other  than  to  hack  ex¬ 
ternal  systems,  thus  breaking  the  law  and  resulting  in  prosecution  if 
they  were  caught.  The  dominant  paradigm  of  how  “harmless  computer 
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trespass”  crimes  are  distin¬ 
guished  from  computer  felo¬ 
nies  is  obscure  and  may  have 
resulted  in  overprosecution.17 

Today,  technology  makes 
this  dilemma  a  null  point. 

One  hacker  we  interviewed 
noted  that — unlike  in  the 
past  30  years — inquisitive 
hackers  can  develop  their 
own  isolated  virtual  machine 
infrastructures  on  a  non- 
network- connected  personal 
computer  to  tinker  with  tac¬ 
tics,  techniques,  and  proce¬ 
dures  (TTP)  without  breaking 
the  law.  The  computing  power 
and  random  access  memory 
(RAM)  required  to  do  so  was 
not  available  at  low  cost  in 
the  1980s  and  1990s.  Now 
someone  can  create  this  in¬ 
frastructure  for  the  cost  of  a  typical  desktop  or  laptop  computer  con¬ 
figuration  (see  inset).  Inquisitive  hackers  with  access  to  malware 
could  set  up  their  own  “cyber  range”  on  a  single  computer  by  running 
a  virtual  machine  network  allowing  them  to  set  up  botmaster,  victim, 
and  hot  propagator  computers.  This  strategy  would  allow  them  to  un¬ 
derstand  how  to  hack  in  a  way  that  does  not  break  the  law.  Malware 
researchers  use  this  technique  to  reverse-engineer  and  understand 
malicious  software  without  affecting  the  open  Internet.18  The  argu¬ 
ment  that  one  was  being  “inquisitive”  when  conducting  an  act  of  cy¬ 
bercrime  is  no  longer  as  valid  as  it  was  in  the  past.  Further,  despite 
media  portrayals  of  government  agencies  such  as  the  FBI  discussing 
whether  or  not  to  loosen  restrictions  on  hiring  criminal  hackers  or 
drug  users  if  they  have  special  hacking  skills,  this  option  is  not  the 
wave  of  the  future.19 

A  key  finding  of  this  study  is  that  Air  Force  and  government  lead¬ 
ers  have  bought  into  the  stereotype  that  the  kind  of  people  who  are 
good  at  OCO/DCO  are  potentially  overweight,  socially  awkward 
drug  users.  This  perception  clashes  with  the  realities  of  individuals 


The  Inquisitive  Hacker  Requirements 

to  Set  Up  a  Legal  Hacking  Lab  in  the 
Comfort  of  Your  Home 

Cyber  Skills 

•  Sufficient  knowledge  of  Linux  to  use  Kali  as 
the  attacking  platform;  ability  to  navigate 
through  directories,  execute  scripts  and 
tools,  and  write  basic  bash  scripts;  a  solid 
understanding  of  TCP/IP  and  various  net¬ 
work  services  (DNS,  DHCP,  etc.) 

•  Knowledge  of  Web  programming  lan¬ 
guage  (HTML,  CSS,  etc.) 

•  Knowledge  of  scripting  language  (Perl, 
Python,  Ruby) 

•  Understanding  of  information  security 
verbiage  and  concepts 

•  Patience  and  a  desire  to  learn 

Technology 

•  VMware  workstation/Fusion  installed 

•  At  least  60  gigabytes  free  on  hard  drive 

•  Wired  network  support 

•  Universal  Serial  Bus  (USB)  2  or  higher 
support 

•  A  reasonably  sized  display 
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within  the  hacker  community,  many  of  whom  are  insulted  by  these 
stereotypes.  We  discovered  that  as  senior  leaders  make  statements 
that  include  such  derogatory  stereotypes  and  thus  perpetuate  them, 
talented,  fit,  and  morally  upstanding  individuals  with  hacking  talent 
are  not  motivated  to  enter  the  ranks  of  public  service.  Although  core 
values  are  important,  one  discussant  mentioned  the  noteworthy 
point  that  cyber  operators  are  often  those  who  view  mission  accom¬ 
plishment  as  the  highest  goal.  These  operators  are  willing  to  hack  a 
system  to  get  a  job  done,  believing  that  doing  so — even  to  their  own 
system — will  incur  a  smaller  penalty  than  failing  to  complete  a  proj¬ 
ect  on  time.  This  mind-set,  however,  flies  in  the  face  of  current  DOD 
policies.  Indeed,  anecdotal  evidence  surfaced  during  the  study  that 
although  a  cyber  operator  might  have  TS/SCI  clearances  from  the  Air 
Force  or  DOD,  these  may  not  transfer  to  the  NSA  because  of  viola¬ 
tions  of  IT  policy  that  amount  to  office  pranks — take  for  example  an 
Airman  who  decides  to  hack  into  his  boss’s  computer  to  put  a  “best 
boss  in  the  world”  logo  on  his  startup  screen.  This  action  runs  afoul 
of  Air  Force  policies  of  unauthorized  access  and  would  prevent  the 
Airman  from  gaining  clearance  to  operate  at  USCYBERCOM. 

One  model  akin  to  the  DOD  in  placing  strict  compliance  stan¬ 
dards  on  its  IT  staff  is  found  in  the  financial  industry,  where  the  costs 
of  inadvertent  hacking  are  high.  In  that  sector,  operators  are  bound  to 
follow  security  rules  because  of  Securities  and  Exchange  Commis¬ 
sion  (SEC)  and  Financial  Industry  Regulatory  Authority  regulations 
and  the  Gramm-Leach-Bliley  Act,  among  other  guidelines.  Accord¬ 
ing  to  SEC  commissioner  Luis  A.  Aguilar,  such  regulations  create  a 
climate  in  which  the  boards  are  accountable  for  cybersecurity  and 
thus  must  “ensure  that  management  has  implemented  effective  risk 
management  protocols.”  He  adds  that  “boards  of  directors  are  already 
responsible  for  overseeing  the  management  of  all  types  of  risk,  in¬ 
cluding  credit  risk,  liquidity  risk,  and  operational  risk — and  there  can 
be  little  doubt  that  cyber-risk  also  must  be  considered  as  part  of 
board’s  overall  risk  oversight.”20  Therefore,  it  is  essential  that  cyber 
operators  in  the  USAF  and  across  government  are  aware  of  the  zero 
tolerance  of  “cyber  pranks”  and  the  potential  negative  effect  on  their 
career  progression  and  acceptance  to  the  CMF. 

Overall,  this  study  finds  that  the  Air  Force  should  not  hire — under 
any  circumstances — anyone  who  does  not  adhere  to  the  service’s  core 
values.  It  should  not  amend  its  requirements  to  find  suitable  candidates 
for  cyber  operator  roles.  Moreover,  the  Air  Force  should  not  put  na- 
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tional  security  missions  at  risk  by  actively  recruiting  from  the  de¬ 
structive  hacker  pool.  Instead,  it  should  leverage  games  and  compe¬ 
titions  to  serve  as  an  outlet  for  those  with  inquisitive  hacking  skills 
and  instill  our  core  values  into  individuals  who  aspire  to  join  the 
ranks  of  the  “good  guys”  defending  the  nation  in  the  role  or  capacity 
they  choose. 

Games  and  Competitions  as  Recruitment  Tools 

Games  and  competitions  are  another  legal  outlet  that  the  Air  Force 
and  DOD  can  leverage  to  attract  talent  into  the  workforce.  The  Air 
Force  Associations  (AFA)  CyberPatriot — a  yearlong  national  contest 
that  pits  the  six-member  teams  against  26  other  high  schools  and  2 
middle  schools — is  one  starting  point.  It  is  not  designed  to  be  an  Air 
Force  recruitment  tool  but  an  AFA  effort  to  increase  awareness  of 
cyberspace.  Its  goal  is  to  attract  students  in  middle  and  high  school  to 
the  cyber  domain  so  that  they  enroll  in  STEM  degree  programs  in 
college.  However,  as  currently  structured,  CyberPatriot  does  not  fit 
the  bill  for  providing  a  legal  outlet  for  hacking  skills  that  OCO/DCO 
recruits  could  bring  to  the  cyber  fight.  One  of  its  operating  principles — 
cyber  citizenship — states,  “The  CyberPatriot  competition  teaches  In¬ 
ternet  ethics  and  safety  and  defensive  activity  only.  It  is  not  a  hacking 
competition  nor  does  it  teach  or  tolerate  hacking  or  any  activity  re¬ 
lated  to  the  unauthorized  entry,  use,  or  modification  of  a  computer, 
system,  or  network  by  a  person,  persons,  or  tools.”21  As  confirmed  in 
interviews  with  AFA  personnel,  this  parameter  is  a  result  of  risk  aver¬ 
sion  on  the  part  of  AFA  leadership  to  avoid  the  perception  of  the  as¬ 
sociation  sponsoring  a  hacking  competition.  Consequently,  talented 
potential  recruits  for  cyber  operations  may  be  more  attracted  to  the 
DEFCON,  Black  Hat,  and  CanSecWest  hacking  conferences  where 
“black  hat”  and  “white  hat”  hackers  converge  to  share  true  hacking 
techniques,  not  the  latest  patch-management  delivery  methods. 

Hence,  due  to  the  focus  on  CyberPatriot,  the  USAF  maybe  missing 
an  entire  talent  pool  that  has  no  incentive  to  show  off  its  innovative 
hacking  techniques  but  is  inclined  to  enter  the  cyber  fracas  provided 
by  other  hacking  competitions.  This  study  concludes  that  the  USAF 
can  take  one  of  two  actions.  One  is  to  encourage  the  AFA  to  redirect 
CyberPatriots  mission  to  encourage  offensive-type  activity  in  the 
competition.  The  other  is  for  the  USAF  to  create  its  own  hacking 
competition  modeled  after  cyber  games  held  at  DEFCON  or  Black  Hat 
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and  similar  competitions  that  the  National  Initiative  for  Cybersecurity 
Careers  and  Studies  tracks  in  its  Cyber  Competition  Project.22 

Another  issue  with  CyberPatriot  is  that  it  instills  a  “defend  every¬ 
thing,  don’t  let  anything  get  through”  mentality  in  students.  Doing  so 
might  be  good  in  a  game  situation,  but  it  does  not  accurately  reflect  a 
cyber  warfare  environment.  Rather,  CyberPatriot  should  emphasize  a 
mission  assurance  paradigm  in  which  students  understand  the  im¬ 
portance  of  key  cyber  aspects  of  the  specific  mission  being  defended; 
recognize  which  functions  are  essential  to  assure  mission  success; 
prioritize  the  defense  of  these  cyber-enabled,  mission-essential  func¬ 
tions;  and  then  perform  the  appropriate  level  of  defense  that  the  mis¬ 
sion  requires.  If  the  USAF  were  informing  the  competition,  points 
could  be  awarded  for  innovative  methods  in  achieving  offensive  and 
defensive  goals  if  and  only  if  the  behavior  occurred  within  the  com¬ 
petition  network  or  the  confines  of  the  controlled  competition  envi¬ 
ronment.  The  research  team  concludes  that  CyberPatriot  and  other 
cyber  competitions  would  be  enhanced  if  this  mission  assurance  in¬ 
stead  of  a  patch-management  paradigm  were  more  deeply  embedded 
in  the  cyber  competition  scenarios. 

Growing  the  Civilian  Workforce 

The  success  of  scholarship/internship  programs  as  civilian  recruit¬ 
ment  tools  within  the  DOD  and  other  government  agencies  is  a  use¬ 
ful  model  for  recruiting  talented  students  into  the  Air  Forces  civilian 
workforce,  attracting  new  students  and  renewing  the  workforce  as 
people  retire.  Internships  allow  for  the  controlled  funding  and  man¬ 
agement  of  accessions  and  have  been  advantageously  used  in  the 
USAF  to  gain  skilled  people.23  The  Pathways  Program  provides  eli¬ 
gible  students  with  paid  opportunities  to  work  in  and  explore  federal 
careers  while  they  are  still  in  school.  Another  initiative  that  specifi¬ 
cally  aims  to  bolster  civilians  with  STEM  degrees  is  the  Science, 
Mathematics,  and  Research  for  Transformation  (SMART)  scholar¬ 
ship  program,  part  of  the  National  Defense  Education  Program. 
SMART  participation  is  limited  to  US  citizens  who  can  obtain  and 
maintain  a  security  clearance;  are  pursuing  undergraduate,  master’s, 
and  doctoral  degrees;  and  have  demonstrated  ability  and  special  apti¬ 
tude  for  excelling  in  STEM  fields.  Upon  acceptance  into  the  program, 
students  receive  full  tuition  and  education-related  fees,  a  stipend,  a 
health  insurance  allowance,  summer  research  internships,  and  other 
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benefits.24  Upon  completion  of  their  studies,  graduates  are  assigned 
to  a  DOD  laboratory  for  a  period  of  postgraduation  employment  ser¬ 
vice  as  a  DOD  civilian,  based  on  how  many  academic  years  they  re¬ 
ceived  funding  from  the  SMART  program.25  However,  although  the 
program  concentrates  on  STEM,  it  does  not  stress  cyber-specific 
STEM  (fig.  9). 


Aeronautical  and 
Astronautical  Engineering:  7% 

Biosciences:  5% 

Chemical  Engineering:  1% 

Chemistry:  3% 

Civil  Engineering:  6% 

Cognitive,  Neural,  and 
Behavioral  Sciences:  1% 

Computer  and 
Computational  Science:  13% 

Electrical  Engineering:  22% 

Geosciences:  2% 

Industrial  and 
Systems  Engineering:  5% 

Information  Sciences:  1% 

Materials  Science  and 
Engineering:  3% 

Mathematics:  5% 

Mechanical  Engineering:  17% 


Naval  Architecture  and 
Ocean  Engineering:  2% 

Nuclear  Engineering:  2% 

Oceanography:  1% 

Operations  Research:  1% 

Physics:  3% 


Figure  9.  Percentage  of  SMART  funds  awarded  by  discipline.  (Repro¬ 
duced  from  "SMART  Program  Stats,  2014  Award  Statistics,"  SMART,  http:// 
smart.asee.org/program_stats/2014_award_data.) 

Another  potential  civilian  cyber  force  multiplier  is  the  Cyber  ACE 
(Advanced  Course  in  Engineering)  Information  Assurance  Internship 
Program,  which  runs  for  three  months  in  the  summer  at  the  Air 
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Force  Research  Laboratory  in  Rome,  New  York.  As  of  this  writing, 
however,  the  program  has  received  no  Air  Force  funding.  The  pro¬ 
gram’s  mission  is  to  develop  the  next  generation  of  cyber  leaders  with 
the  attributes  of  technical  excellence,  leadership  ability,  and  commu¬ 
nication  skills.26  To  be  eligible  for  the  internship,  candidates  must  be 
enrolled  in  an  undergraduate  course  of  study,  have  US  citizenship, 
qualify  for  a  DOD  Secret  clearance,  and  have  a  cumulative  grade 
point  average  of  3.5  or  higher  in  their  academic  program.  Once  ac¬ 
cepted,  students  are  given  a  full-time  paid  research  internship  that 
allows  them  to  hone  their  technical  skills  while  they  work  on  cutting- 
edge  research.  ACE  also  seeks  to  develop  future  cyber  leaders  for  the 
USAF  who  understand  technology,  leadership,  and  principles  of  risk 
management.  The  program’s  graduates  are  shining  examples  of  cyber 
leaders  across  the  DOD.  For  instance,  the  Air  Force’s  2013  Computer 
Network  Operations  Development  Program  consisted  entirely  of 
ACE  graduates.  The  program  has  also  seen  its  first  squadron  detach¬ 
ment  commander  (315th  Network  Warfare  Squadron/Detachment 
2)  and  can  claim  distinguished  graduates  in  the  USAF’s  Remotely  Pi¬ 
loted  Aircraft  course  and  the  3d  Combat  Communications  Group  / 
Combat  Readiness  School.  Moreover,  huge  contingents  at  Twenty- 
Fourth  Air  Force  and  NSA/USCYBERCOM  are  ACE  graduates.  The 
program  could  use  a  million  dollars  per  year  of  Air  Force  program 
objective  memorandum  (POM)  dollars  to  keep  graduating  30-40 
students  each  year — or  only  $25K-$30K  per  student  (see  chap.  7  for 
more  detail  on  ACE).27 

One  model  to  ramp  up  the  production  of  civilians  for  the  cyber 
workforce  is  the  DHS’s  CyberCorps  Scholarship  for  Service.  The 
OPM  states  that  this  is  a  “unique  program  designed  to  increase  and 
strengthen  the  cadre  of  federal  information  assurance  professionals” 
by  offering  scholarships  that  may  fund  the  entire  cost  of  attending  a 
participating  university.  In  addition,  the  program  provides  yearly  sti¬ 
pends  ranging  from  $20K  to  $30K  for  undergraduate  through  doc¬ 
toral  students.  The  scholarships  are  funded  through  grants  awarded 
by  the  National  Science  Foundation.28 

Although  CyberPatriot’s  goal  is  to  steer  students  with  a  STEM  back¬ 
ground  into  careers  in  cybersecurity,  it  does  not  foster  locating  people 
who  have  an  aptitude  for  thinking  outside  the  box  in  cyber  operations. 
This  dilemma  exists  not  only  in  the  Air  Force  but  also  throughout  the 
government.  The  USAF  needs  to  collaborate  across  interagencies  on 
talent  pipeline  management.  The  success  of  scholarship/internship 
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programs  as  civilian  recruitment  tools  at  other  agencies/departments 
portends  a  useful  model  for  the  USAF’s  civilian  workforce. 

Retain 

Retention  of  personnel  depends  on  a  variety  of  factors,  such  as  pay, 
currency  training,  furloughs,  and  the  ability  to  attend  professional 
non-DOD  conferences.  Due  to  existing  budgetary  constraints,  the 
Air  Force  cannot  compete  with  the  compensation  offered  by  the 
commercial  and  private  sectors.29  However,  it  does  provide  individu¬ 
als  with  opportunities  that  are  unmatched  outside  the  military.  The 
fact  that  most  individuals  in  the  cyber  workforce  opt  to  stay  in  the 
military  produces  a  low  attrition  rate.  However,  this  result  cannot  be 
taken  as  a  good-news  story  since  the  quality  of  personnel  leaving  the 
service  was  not  quantifiable.  Anecdotal  evidence  indicates  that  the 
best  and  brightest  tend  to  leave  the  active  force.  This  study  also  found 
that  retention  dynamics  are  associated  with  the  job  satisfaction  de¬ 
rived  from  performing  key  tasks  related  to  national  defense.  As  long 
as  these  operators  are  not  transferred  to  positions  away  from  national 
missions,  high  retention  will  likely  persist.  However,  because  the 
needs  of  the  Air  Force  outweigh  individual  preference,  it  cannot 
guarantee  cyber  operators  that  they  will  not  be  transferred  to  other 
positions.  When  such  transfers  occur,  other  incentives  should  exist  to 
retain  these  highly  skilled  operators. 

The  USAF  must  be  able  to  manage  its  personnel.  This  study  found 
several  cases  in  which  contractors  had  recruited  operators  directly 
from  the  operations  floor.  Because  of  Privacy  Act  restrictions,  the  re¬ 
search  team  could  not  question  them  personally.  However,  it  learned 
that  these  senior  noncommissioned  officers  (NCO)  left  the  Air  Force 
less  than  24  months  from  retirement  as  a  result  of  being  reassigned 
off  the  USCYBERCOM  ops  floor.  Consequently,  they  remained  in 
cyber  operations  in  contractor  status,  at  a  higher  salary,  without  hav¬ 
ing  to  relocate.  Therefore,  we  recommend  that  the  USAF  explore  the 
legalities  of  including  noncompete  clauses  in  contractor  agreements 
so  that  contractors  are  prohibited  from  recruiting  or  hiring  Air  Force 
members  more  than  one  year  from  retirement. 

The  service  needs  to  provide  a  career  path  for  cyber  operators  that 
offers  both  the  discipline  and  agility  to  align  their  talents  for  the  Air 
Force’s  cyber  mission.  The  best  retention  of  cyber  operators  (17S, 
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1B4,  3D,  and  14N)  occurs  in  operational  units  while  the  highest 
losses  come  when  these  personnel  are  assigned  to  duties  outside  an 
operational  unit  and  must  depart  the  “cyber  cockpit.”  Multiple  back- 
to-back  assignments  to  such  units  appear  likely  to  reduce  attrition. 
Therefore,  there  may  be  a  need  to  manage  this  group  of  people  like  a 
very  specialized  corps. 

One  could  argue  that  cyber  operators  wanting  to  specialize  sounds 
exactly  like  what  pilots  want  to  do:  fly.  However,  in  cyberspace,  this 
analogy  is  flawed.  Combat-qualified  pilots  are  limited  by  biology  to 
how  many  years  they  can  fly  with  the  same  efficiency  and  effective¬ 
ness.  Flying  in  high  or  low  g-force  environments  during  training  or 
military  operations  places  the  human  body  under  stress  that  wears 
down  a  pilot’s  ability  to  fly  over  time.30  Even  if  pilots  want  to  focus  on 
flying  for  their  entire  Air  Force  career,  biologically  they  would  not  be 
able  to  remain  mission  qualified  due  to  physiological  and  psycho¬ 
logical  stressors  on  the  body.  In  cyberspace,  the  exact  opposite  is  true 
because  of  the  interplay  among  human  cognition,  digital  technology, 
and  the  complex  sociotechnical  interactions  required  in  cyber  opera¬ 
tions.31  Experience  and  hands-on  console  time  increase  combat  ef¬ 
fectiveness  in  all  fields  of  cyber  operations.  For  example,  to  recognize 
anomalous  patterns,  cyber  operators  must  understand  a  normal  one; 
that  ability  can  be  developed  only  over  time  and  with  more  experi¬ 
ence.  If  cyber  operators  cannot  recognize  anomalies,  their  ability  to 
operate  effectively  will  be  limited.  Hence,  developing  these  individu¬ 
als  with  specialized  experience  in  DODIN,  DCO,  or  OCO  roles 
breeds  expertise  and  allows  for  more  real-world  efficiency  over  time. 

Stress  exists  in  the  human-technology  interface  of  every  military 
mission  set.  In  cyberspace  the  complex  interactions  of  humans  and 
technology  increase  cerebral  stress  on  an  operator  above  that  experi¬ 
enced  in  typical  military  and  intelligence  applications.32  Cyberspace 
is  a  highly  dynamic  domain,  and  decisions  must  be  made  on  incom¬ 
plete  or  deceptive  information.  Massive  data  may  indicate  that  an  at¬ 
tack  is  under  way  or  that  it  may  just  be  an  anomaly.  By  itself,  the  sheer 
volume  of  data  overwhelms  the  limited  data-processing  capability  of 
the  human  brain  as  it  tries  to  sift  through  both  the  technical  data 
dumps  that  may  indicate  either  false  positives  or  complex,  multistage 
attacks.33  In  DCO,  intrusion  detection  systems  aid  operators  in  iden¬ 
tifying  threats  by  presenting  them  with  data  sources  such  as  firewall 
logs  and  vulnerability  reports.  Granted,  this  complexity  has  moti¬ 
vated  the  development  of  a  variety  of  automated  tools  to  assist  opera- 


RECRUIT,  RETAIN,  REGAIN  67 


tors  in  identifying  cyber  threats  and  vulnerabilities.18  However,  re¬ 
searchers  at  the  AFRLs  711th  Human  Performance  Wing  have 
determined  that  suspicion  of  the  data  may  degrade  human  perfor¬ 
mance  because  of  the  “simultaneous  state  of  cognitive  activity,  uncer¬ 
tainty,  and  perceived  malintent  about  underlying  information  that  is 
being  electronically  generated,  collated,  sent,  analyzed,  or  imple¬ 
mented  by  an  external  agent.”19  Hence,  it  is  up  to  an  individual  opera¬ 
tor  to  trust,  suspect,  or  mistrust  the  data  to  provide  some  response. 
The  ability  to  make  the  right  decisions  in  an  accurate  and  timely 
manner  depends  on  situational  awareness  derived  from  experience 
and  mental  agility.36 

As  of  this  writing,  Vint  Cerf,  one  of  the  founding  fathers  of  the 
TCP/IP  protocol  that  is  the  backbone  of  the  current  Internet  is  71 
years  old.  However,  with  a  hands-on  keyboard  and  an  agile  mind,  he 
continues  to  contribute  to  furthering  the  technical  theory  and  prac¬ 
tice  in  the  domain.37  A  pilot  simply  would  not  be  able  to  make  this 
contribution  by  strapping  into  the  cockpit  at  the  age  of  71  to  demon¬ 
strate  a  new  TTP. 

Better  retention  may  reduce  training  demand  signal  /  accessions 
requirements.  However,  more  data  is  needed  to  attempt  to  quantify 
this  impact. 


Regain 

Perhaps  no  task  in  the  cyber  realm  is  as  daunting  for  the  USAF  as 
recruiting  and  retaining  the  “right  people”  and  ensuring  they  stay 
competitive  with  their  peers  in  other  career  fields.  Over  time,  the  cor¬ 
porate  USAF  is  realizing  that  maintaining  a  skilled  and  technically 
current  cyber  workforce  in  the  face  of  rapidly  shifting  technology 
from  one  paradigm  to  the  next  is  increasingly  difficult.  Perhaps  a 
unique  aspect  of  emerging  technologies  in  the  cyber  realm  is  that 
even  the  poorest  adversaries  can  stay  current  on  the  developments 
because  of  the  ease  with  which  the  technology  proliferates.  This  phe¬ 
nomenon  could  drive  a  need  for  the  USAF  to  find  a  way  to  allow 
talented  members  of  the  cyber  workforce  to  gain  knowledge  in  ways 
that  it  simply  can’t  match. 

According  to  Federal  Computer  Week,  USCYBERCOM  will  look 
to  recruit,  and  undoubtedly  retain,  approximately  5,000  new  cyber 
professionals  in  the  near  future.38  Where  and  how  AFPC  and  core 
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cyber  AFSC  representatives  vector  these  new  personnel  for  successful 
career  and  expertise  progression  will  be  a  critical  piece  of  the  puzzle. 
Exclusive  to  the  cyber  realm  is  the  ever-evolving  nature  of  the  tech¬ 
nology  that  actually  drives  the  cyber  “battlefield.”  As  such,  consideration 
should  be  given  to  allowing  officers  and  enlisted  personnel  a  path  to 
explore  the  civilian  sector  so  they  can  gain  valuable  expertise  and  human 
networking  links  that  can  be  garnered  only  from  the  civilian  sector. 
The  “off-ramp”  from  military  service  may  take  several  forms,  each 
permitting  the  military  to  retain  personnel  while  diversifying  their 
experience  and  expertise.  This  study  focuses  on  the  less  traditional 
ideas  for  allowing  a  member  to  depart  and  return  to  service. 

One  method  of  achieving  this  goal  would  be  for  the  USAF  to  con¬ 
sider  various  types  of  “on-  and  off-ramps”  that  give  select  individuals 
an  opportunity  to  separate  from  uniformed  service,  enter  the  private 
sector,  and  then  return  at  a  later  date  as  a  uniformed  member  either 
via  active  duty,  the  Guard,  or  the  Reserve.  A  similar  program  an¬ 
nounced  in  May  2014,  the  Career  Intermission  Pilot  Program  (CIPP), 
will  allow  members  to  take  a  period  of  time  outside  the  Air  Force  to 
pursue  personal  goals  and  return  at  a  later  date  with  no  adverse  effect 
on  their  careers.39  The  CIPP  could  be  adapted  and  expanded  to  allow 
cyber  warriors  to  exit  the  Air  Force  and  obtain  degrees  or  work  in  the 
civilian  sector,  gaining  potentially  vital  experience  they  can  then 
bring  back  with  them  to  the  service.  Presenting  skilled  individuals 
with  such  an  accommodation  can  help  solidify  the  cutting-edge  hu¬ 
man  knowledge  that  the  future  cyber  force  will  require  to  remain  rele¬ 
vant  as  a  war-fighting  capability. 

An  added  benefit  to  an  adapted  CIPP  for  cyber  would  be  the  po¬ 
tential  relationships  and  partnerships  that  the  USAF  could  gain  in 
the  civilian  sector.  As  discovered  in  interviews  with  private- sector 
businesses,  some  amount  of  friction  has  been  generated  between  the 
military  and  the  civilian  cyber  sector  due  to  events  precipitated  by 
people  such  as  Edward  Snowden.  An  adapted  CIPP  could  help  to 
eliminate  such  strains  and  create/rebuild  strong  ties  within  the  vari¬ 
ous  military  and  civilian-sector  organizations  that  benefit  from  this 
program.  Another  point  to  consider  is  that  such  a  program  might 
also  recommend  that  some  of  these  cyber  intermission  program  par¬ 
ticipants  be  pointed  in  the  direction  of  venture  capitalists/startup 
companies.  Many  of  today’s  newest  technologies  existed  only  in 
someone’s  garage  10  years  ago. 
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At  face  value,  the  suggestion  of  on-/off-ramps  seems  innocuous 
and  a  common-sense  approach  to  cyber  force  management;  how¬ 
ever,  the  task  of  developing  and  maintaining  these  programs  may  not 
be  as  simple.  The  mere  suggestion  of  voluntarily  separating  and  later 
reacquiring  cyber-sawy  officers  and  enlisted  personnel  is  not  without 
difficulty  since  several  pieces  of  the  personnel  puzzle  will  require  fur¬ 
ther  inquiry.  This  brief  investigation  simply  scratches  the  surface  of  a 
potential  tool  for  keeping  the  right  people  and,  equally  important, 
growing  them  in  the  right  way.  Such  an  undertaking  can  be  as  simple 
as  assuring  those  individuals  who  separate  that  they  may  return 
within  three  years  in  a  seamless  way  to  other,  more  selective  pro¬ 
grams.  This  study  also  acknowledges  a  few  of  the  challenges  the  per¬ 
sonnel  system  will  have  to  overcome.  If  this  path  is  undertaken,  the 
book  may  need  to  be  rewritten  with  regard  to  what  USAF  leadership 
looks  at  when  considering  individuals  for  selection  to  these  special 
programs  and  for  promotion. 

Another  such  ramp  could  be  similar  to  Palace  Chase  and  would  be 
contingent  on  successful  employment  with  cyber  companies.  Indi¬ 
viduals  would  owe  a  commitment  to  the  Air  Force  Reserve  (AFR)  or 
Air  National  Guard  (ANG)  in  the  field  of  cyber  and  be  subject  to  a 
nondisclosure  agreement  with  the  employing  cyber  company.  One 
appropriate  path  involves  attaching  those  members  to  a  predeter¬ 
mined  unit  based  on  the  location  of  their  civilian  employment.  Each 
individual’s  prescribed  service  commitment  would  be  designed  as  the 
best  balance  between  the  interest  and  goals  of  the  individual  and  the 
needs  and  requirements  of  the  Air  Force.  As  a  result,  a  one-size-fits- 
all  commitment  would  not  be  appropriate. 

An  additional  possibility  would  be  something  similar  to  the  Air 
Force  Fellows  program.  In  this  instance,  however,  the  parameters 
would  differ  in  that  it  would  essentially  put  a  service  member  on  sab¬ 
batical — effectively  separated  from  military — and  free  to  pursue  a 
career  with  a  select  company  recognized  in  the  cyber  industry.  At  the 
end  of  a  given  period,  that  individual  would  be  contractually  obli¬ 
gated  to  return  to  active  duty  and  serve  out  a  minimum,  predeter¬ 
mined  active  duty  service  commitment  (ADSC).  Such  a  program 
would  again  require  a  process  to  select  the  appropriate  rank  and  career 
for  individuals  to  separate  and  remain  competitive  when  they  return. 
This  program  would  be  similar  to  the  CIPP,  which  allows  Airmen  to 
separate  and  return  to  active  duty  with  an  ADSC  but  in  a  different 
year-group  for  promotion.40  Although  a  basic  framework  exists  for 
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programs  such  as  this  one,  overcoming  internal  and  external  chal¬ 
lenges  will  require  some  work. 

Implementing  these  ideas  will  necessitate  a  change  in  the  general 
view  of  a  break  in  service  as  a  negative  career  move.  The  message 
needs  to  be  loud  and  clear  that  these  members  serve  a  purpose  and 
that  the  break  allows  them  to  return  to  the  force  as  warriors  sharp¬ 
ened  by  a  heightened  awareness  of  the  latest  cyber  trends,  technol¬ 
ogy,  and  threats.  Additionally,  the  general  cyber  force  needs  to  un¬ 
derstand  that  these  programs  are  competitive  in  nature  and  that 
selection  for  such  a  program  highlights  the  members  future  potential 
in  the  USAF.  Similar  to  selection  for  intermediate  or  senior  develop¬ 
mental  education  in-residence,  being  chosen  for  one  of  these  oppor¬ 
tunities  would  highlight  an  individual  for  future  leadership  and  advi¬ 
sory  roles  in  the  USAF.  Subject  matter  experts  must  come  together  to 
consider  these  challenges  and  set  a  clearly  defined  way  ahead  to  miti¬ 
gate  and  address  them. 

Offering  USAF  members  the  ability  to  off-ramp  from  the  service 
and  then  later  on-ramp  is  a  crucial  part  of  maintaining  a  healthy,  rele¬ 
vant  cyber  force  leadership  pool.  Affording  our  cyber  warriors  the 
chance  to  become  experts — not  only  through  DOD/USAF  training 
but  also  through  direct  interaction  with  industry  leaders  in  cyber  and 
cyber  security — would  build  a  robust  structure  within  the  crew  force 
and  ensure  that  the  USAF  stays  at  the  cutting  edge  of  trends  and  tech¬ 
nology.  Making  these  programs  work,  from  the  simple  (e.g.,  allowing 
seamless  transitions  for  voluntary  separations  and  return  to  active 
duty)  to  the  more  complex  (such  as  a  Palace  Chase-type  or  adapted 
CIPP  program),  will  require  thinking  outside  the  box,  revisiting  old 
ideas,  and  inventing  new  ones. 

The  Air  Force  Warrant  Officer  and  Cyber 
Technology:  A  Good  Fit? 

In  response  to  questions  regarding  force  structure,  the  research 
team  examined  whether  alternative  personnel  constructs — including 
reestablishment  of  the  warrant  officer  (WO)  corps — would  enhance 
cyberspace  force  recruitment,  development,  and  retention.  For  rea¬ 
sons  described  here,  the  team  concluded  that  these  options  would  not 
add  value  within  the  cyber  enterprise. 
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The  genesis  of  the  question  of  alternative  personnel  management 
constructs  lies  in  the  need  for  long-term  commitments,  the  focus  to 
maintain  cyber  proficiency,  and  the  disruptive  effect  on  this  focus 
that  can  be  generated  by  the  normal  Air  Force  assignment  process.  As 
stated  above,  the  study  concluded  that  once  cyber  proficiency  and 
experience  are  obtained,  skilled  practitioners  should  remain  in  the 
field  and  rise  through  the  ranks  into  supervision.  Over  time,  this 
practice  will  generate  a  cadre  of  cyber  professionals  consisting  of 
midgrade  enlisted  personnel  and  junior  officers.  One  proposed  solu¬ 
tion  to  the  technical  expertise  /  longevity-in-the-job  conundrum  is 
reinstatement  of  the  Air  Force  WO  program.  Members  of  both  the 
cyber  officer  and  enlisted  corps  suggested  early  in  the  study  that  the 
use  of  WOs  would  provide  stability  in  the  cyber  arena,  offer  needed 
continuity  of  effort/expertise,  and  bridge  the  gap  between  officers 
and  enlisted  personnel. 

WOs  are  authorized  by  10  US  Code,  section  571,  and  have  two 
rank  tiers.41  The  respective  service  secretaries  may  appoint  the  grade 
of  regular  warrant  officer,  W-l,  either  by  warrant  or  commission.42 
Any  promotions  or  appointments  to  the  subsequent  chief  warrant  of¬ 
ficer  grades  (W-2  through  W-5),  called  the  regular  officer  grades, 
must  be  made  by  presidential  commission. 

Historically,  the  Air  Force  Warrant  Officer  Program  was  a  legacy 
from  the  Army  Air  Corps,  a  holdover  rank  structure  that  came  with 
the  creation  of  the  Air  Force  in  1947.  Earlier,  the  Army  Warrant  Of¬ 
ficer  Program  had  an  up-and-down  existence  in  the  interwar  years 
and  was  primarily  used  to  reward  NCOs  for  superior  performance 
and  as  a  career  advancement  tool  for  those  Soldiers  too  old  to  be 
commissioned  as  lieutenants.43  The  use  of  WOs  grew  during  World 
War  II  as  the  need  for  technicians  increased  exponentially  during  the 
conflict.  Following  the  creation  of  a  separate  Air  Force,  they  contin¬ 
ued  to  fill  jobs  in  numerous  technical  fields  for  the  next  decade.  How¬ 
ever,  WOs  fell  into  a  rank/social/supervisory  category  in  the  new  Air 
Force  that  one  author  described  as  being  “neither  fish  nor  fowl.”44 
With  the  advent  of  the  “supergrades”  of  E-8  and  E-9  by  the  Military 
Pay  Act  of  1958,  21,000  new  enlisted  authorizations  were  added  to 
Air  Force  rolls — authorizations  originally  slated  for  more  WOs  a  few 
years  earlier.45  In  1959  the  Air  Force  vice-chief  of  staff,  Gen  Curtis 
LeMay,  approved  a  plan  to  sharply  reduce  WO  ranks  but — tellingly — 
not  to  completely  eliminate  them,  reasoning  that  they  might  be 
needed  in  the  future.46  Nevertheless,  planners  decided  that  there  was 
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no  need  to  retain  the  WO  program,  in  part  because  WOs  counted 
against  officer  end  strength  and  might  jeopardize  the  growth  of 
company  grade  officer  authorizations  within  the  service.47  In  1980 
the  last  Air  Force  WO  retired  from  active  duty.48  Even  today  the  Air 
Force  WO  program  has  not  been  completely  eliminated;  the  CSAF 
can  revive  it  with  the  stroke  of  a  pen. 

Several  practical  problems  are  associated  with  such  a  revival.  The 
first  concerns  economies  of  scale.  Reviving  an  entire  rank  structure 
for  just  one  career  field — in  this  case,  those  AFSCs  related  to  cyber — 
would  produce  a  requirement  for  only  a  few  hundred  WOs,  given 
current  manning  projections  for  Air  Force  cyber  units.  The  result 
would  be  a  “boutique”  rank  structure  that  would  not  attain  the  re¬ 
spect  or  understanding  that  it  carried  when  the  warrant  system  was 
widely  used,  as  in  World  War  II.  Second,  the  use  of  WOs  actually  re¬ 
duces  the  compensation  the  Air  Force  can  pay  its  personnel.  WOs  in 
the  grades  of  W-2  through  W-5  are  commissioned  officers  and,  in 
accordance  with  Title  10,  are  counted  against  commissioned  officer 
end  strength.  The  pay  for  O-ls  through  0-5s  is  superior  to  that  for 
W-ls  through  W-5s,  thus  reducing  the  compensation  for  Air  Force 
commissioned  billets. 

Reintroduction  of  a  separate  rank  structure  between  enlisted 
members  and  officers  would  entail  the  creation  of  accession  and  pro¬ 
motion  boards  and  an  administrative  overhead  to  manage  them.  Initial 
training  costs,  including  a  WO  course  similar  to  the  Army’s  at  Fort 
Rucker,  Alabama,  would  add  expense.  These  expenses  would  also 
raise  multiple  questions  concerning  WO  recruiting,  personnel  manage¬ 
ment,  and  the  potential  for  “green-to-blue”  (or  vice  versa)  interservice 
transfer  programs. 

The  research  team  found  a  need  for  continuity  in  cyber  warfare 
positions  and  believes  that  certain  specialized  career  fields  will  re¬ 
quire  a  strong  emphasis  on  continuing  training/education  to  main¬ 
tain  currency,  but  it  does  not  advocate  the  reestablishment  of  WOs  as 
the  method  to  achieve  these  ends.  HAF/A2,  in  conjunction  with  Al, 
has  already  designated  the  1N4X1A  AFSC  to  provide  for  sustained 
cyber  intelligence  expertise,  and  the  1B4  and  17-series  career  fields 
can  attain  the  same  ends  in  the  cyberspace  community.  Ensuring  that 
successful  careers  can  be  built  by  cyber  operators  while  they  stay  in 
their  specialty  for  a  longer  time  than  may  be  optimum  for  other  fields 
is  crucial.  Rather  than  the  reintroduction  of  WOs  to  the  Air  Force, 
bonuses  and  other  incentives  that  do  not  impinge  upon  either  long- 
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term  retirement  commitments  or  congressionally  mandated  commis¬ 
sioned  officer  end  strength  seem  preferable  to  addressing  retention. 

Summary 

The  rapid  pace  of  technological  change  is  a  major  concern  in  train¬ 
ing  and  certifying  generic  cybersecurity  personnel.  Air  Force  re¬ 
quirements  for  types  and  numbers  of  cyber  personnel  will  reflect  de¬ 
velopments  in  cyber  technology.  We  recommend  that  the  Air  Force 
continue  to  use  and  update  cyber  tests  to  screen  recruits  for  their 
understanding  of  cyber  technology.  Further,  the  service  should  de¬ 
velop  measures  to  identify  people — in  and  outside  the  service — with 
a  proclivity  toward  hacking.  For  the  OCO/DCO  mission  sets,  it  is 
critical  to  discover  individuals  who  identify  with  Air  Force  core  val¬ 
ues  and  are  innovative,  autodidactic  team  players  who  can  operate 
outside  the  bounds  of  a  TTP  checklist. 

Models  that  predict  cyber  success  are  useful  in  selecting  people 
for  cyber  training  and  could  reduce  washback/washout  rates  at  the 
cyber  schoolhouse.  We  strongly  recommend  that  the  USAF  recruit 
cyber-educated  Airmen.  Further,  it  should  offer  tuition  assistance — 
especially  in  CE  or  EE — to  Airmen  in  the  1B4, 1NX,  and  3D  specialties 
to  enhance  their  education  in  cyber  fields.  As  we  argue  throughout 
this  study,  these  fields  pertain  to  the  national  security  mission  sets 
more  so  than  a  traditional  CS  degree. 

In  our  interviews,  cyber  professionals  indicated  a  strong  bias  to¬ 
ward  the  best  cyber  warrior  possessing  both  a  bachelor  of  science 
degree  in  CE  or  EE  and  a  master  of  science.  Although  cyberspace 
operations  are  as  a  trade  “technologically  heavy,”  this  study  deter¬ 
mined  that  it  is  not  enough  to  have  a  workforce  focused  only  on  the 
STEM  fields.  The  current  nationwide  push  to  increase  STEM  educa¬ 
tion  is  appropriate  given  the  poor  ranking  of  US  students  in  these 
fields  compared  to  that  of  their  global  peers.  However,  a  STEM  back¬ 
ground  is  not  necessarily  indicative  of  a  good  cyber  operator.  Indeed, 
interviews  with  several  government  and  nongovernment  leaders,  as 
well  as  discussions  with  hacker  communities,  indicate  that  creative 
thinking  skills  differentiate  the  best  from  the  rest  in  cyber  operations. 
Therefore,  we  recommend  that  a  portion  of  cyber  operators  continue 
to  be  produced  from  the  arts,  humanities,  and  social  sciences  to  as¬ 
sure  that  cyber  professions  include  a  cadre  of  creative  thinkers  from 
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what  is  referred  to  as  STEAM  (science,  technology,  engineering,  arts, 
and  mathematics)  fields.  The  cyber  field  also  requires  a  cadre  of  law¬ 
yers  and  strategic  plans  and  policy  makers  with  a  cyber  aptitude  to 
craft  and  interpret  laws  and  policy.  Identifying  people  from  STEAM 
fields  with  a  proclivity  for  ethical  hacking  is  a  challenge.  However,  the 
newly  created  cyber  test  being  administered  to  determine  the  techno¬ 
logical  aptitude  of  potential  recruits  is  part  of  the  solution. 

To  attract  the  best  and  brightest  cyber  talent,  senior  US  Air  Force 
and  government  leaders  should  refrain  from  propagating  traditional 
hacker  stereotypes.  These  portrayals  not  only  clash  with  the  realities 
of  hacker  community  characteristics  but  also  disincentivize  talented 
individuals  from  entering  public  service.  In  terms  of  retention,  offer¬ 
ing  duty  assignments  with  interesting  challenges  is  one  way  to  reduce 
the  numbers  of  people  who  leave  the  Air  Force  for  more  lucrative 
careers  in  the  private  sector.  One  policy  mechanism  that  could  facili¬ 
tate  a  healthy,  relevant  cyber  force  and  leadership  pool  involves  giv¬ 
ing  USAF  members  the  ability  to  off-ramp  from  the  service  to  go  to 
the  private  sector  and  then  later  on-ramp.  This  practice  could  help  to 
build  a  robust  structure  in  the  cyber  career  fields  and  ensure  that  the 
USAF  stays  at  the  cutting  edge  of  technology  trends. 


Recommendations  Summary 

•  Examine  ways  to  give  opportunities  to  Airmen  in  other  career  fields  to 
transfer  into  1  7X/1  B4/3D  or  cyber-related  civilian  career  fields. 

•  The  cyber  test  could  be  one  way  to  allow  Airmen  from  other  AFSCs  who 
have  an  interest  in  cyber  or  have  CS,  CE,  or  EE  degrees  to  demonstrate 
their  aptitude  to  be  cyber  warriors. 

•  The  USAF  should  not  put  national  security  missions  at  risk  by  actively 
seeking  to  recruit  from  the  destructive  hacker  pool.  Instead,  it  should  le¬ 
verage  games  and  competitions  to  serve  as  an  outlet  for  people  with  in¬ 
quisitive  hacking  skills  and  instill  our  core  values  into  those  who  aspire 
to  join  the  ranks  of  the  "good  guys"  defending  the  nation  in  the  role  or 
capacity  they  choose. 

•  The  USAF  should  explore  the  legalities  of  including  noncompete  clauses 
within  contractor  agreements  so  contractors  are  prohibited  from  recruiting 
or  hiring  current  USAF  employees  who  are  not  retiring  within  one  year. 

•  Recruit  cyber-educated  Airmen  from  the  1  B4,  1  NX,  and  3D  career  fields. 

•  Offer  tuition  assistance — especially  in  CE  or  EE — to  Airmen  in  the  1  B4, 
1  NX,  and  3D  specialties  to  enhance  their  education  in  cyber  fields. 

•  Continue  to  produce  a  portion  of  cyber  operators  from  the  arts,  humanities, 
and  social  sciences  to  assure  that  cyber  professions  include  a  cadre  of 
creative  thinkers. 
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Chapter  4 


Understanding  the  Impact  of  Millennial 
on  the  Cyber  Workforce 

For  some  readers,  suggesting  that  millennials  (Americans  born 
roughly  between  1981  and  2000)  differ  from  members  of  previous 
generations  in  ways  certain  to  affect  the  USAF’s  ability  to  recruit, 
train,  educate,  and  retain  Airmen  may  appear  a  bold  claim.1  The  reality, 
however,  is  that  a  wealth  of  evidence  drawn  from  more  than  a  decade 
of  interviews,  surveys,  and  other  methods  of  analysis  clearly  suggests 
that  millennials  vary  in  ways  that  will  require  the  Air  Force  to  modify 
how  it  looks  at  its  human  capital. 

To  gain  a  perspective  of  generational  influences,  we  review  distin¬ 
guishing  millennial  attributes  and  then  discuss  the  relationship  be¬ 
tween  maturation  and  generational  issues  and  variances  among  tra¬ 
ditionalists  (1925-45),  boomers  (1946-64),  Xers  (1965-80),  and 
millennials.  Next,  we  examine  how  the  Air  Force  can  effectively  adapt 
to  variations  in  generational  characteristics.2  Given  the  distinct  chal¬ 
lenges  the  service  faces  in  recruiting  high-quality  STEAM  talent, 
simply  ignoring  how  the  current  generation  of  young  Airmen  thinks 
and  acts  is  not  an  option  for  the  Air  Force.3 

These  challenges  are  not  insignificant.  For  example,  in  a  2013  sur¬ 
vey  sponsored  by  Raytheon,  working  as  a  “cybersecurity  professional” 
ranked  12th  in  popularity  among  millennial  respondents,  behind 
such  choices  as  entertainer,  entrepreneur,  doctor,  journalist,  and 
nurse.4  Given  the  limited  appeal  of  the  cyber  field  to  the  current  gen¬ 
eration  and  the  pool  of  qualified  18-to-24-year-old  Americans  from 
which  the  Air  Force  can  draw  (estimated  at  25  percent  of  this  age 
group),  failing  to  modify  the  service’s  approach  to  recruiting,  train¬ 
ing,  educating,  and  retaining  young  Airmen  may  jeopardize  elements 
of  the  Air  Force  mission. 

The  news  is  not  all  bad.  A  2013  survey  of  more  than  9,000  millen¬ 
nials  18-27  years  old  ranked  the  Air  Force  18th  out  of  the  210  most 
desirable  places  to  work.5  When  we  consider  that  the  four  most  im¬ 
portant  “workforce  incentives”  valued  by  millennials  are  interesting 
work,  promotion  opportunities,  competitive  pay,  and  medical  insur¬ 
ance,  the  Air  Force  is  well  positioned  to  compete  effectively  in  a  tight 
marketplace  for  cyber  talent.  However,  contrary  to  popular  belief, 
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service  leaders  should  not  be  willing  to  adapt  and  change  Air  Force 
values  and  to  attune  their  hiring  to  the  misperceptions  of  the  charac¬ 
teristics  of  the  current  generation. 

Who  Are  the  Millennials? 

Born  between  1981  and  2000,  millennials,  or  “Gen  Y”  as  they  are 
also  known,  are  the  first  digital  natives.6  While  previous  generations 
experienced  the  fundamental  changes  brought  about  by  major  tech¬ 
nological  developments,  millennials  have  never  known  a  time  with¬ 
out  computers  and  many  of  the  other  modern  technologies  we  now 
take  for  granted.  Together  with  changing  societal  norms,  demographics, 
parenting  styles,  and  culture,  these  advances  have  influenced  millen¬ 
nials  in  profound  ways.  In  short,  their  values,  beliefs,  and  expecta¬ 
tions  are  very  different  from  those  of  previous  generations. 

Studies  of  millennial  traits  use  descriptors  such  as  entitled,  optimis¬ 
tic,  civic  minded,  close  parental  involvement,  work-life  balance,  impa¬ 
tient,  multitasking,  and  team  oriented.7  Of  specific  importance  to  the 
Air  Force  is  that  millennials  tend  to  view  themselves  as  citizens  of  the 
world  to  a  greater  extent  than  do  members  of  previous  generations.8 
The  ubiquity  and  global  connectivity  of  technology  have  enabled 
them  to  build  relationships,  often  through  social  media,  with  people 
having  similar  interests  from  around  the  world.  As  a  result  of  this 
dramatic  expansion  in  communication,  millennials  often  think  of 
themselves  in  global  rather  than  national  terms.  Since  patriotism  is 
one  prime  motivator  in  attracting  Airmen,  this  stance  may  cause 
concern  when  it  comes  to  questions  of  preference  of  foreign  coun¬ 
tries  on  security  clearance  adjudications  required  to  enter  cyber  op¬ 
erator  career  fields. 

What  may  also  prove  a  challenge  for  the  Air  Force  is  the  strong  aver¬ 
sion  of  millennials  to  the  notion  of  “paying  dues.”9  Rather,  they  are  ac- 
culturated  to  expect  rapid  promotion  if  they  have  the  requisite  skills. 
Given  the  unwillingness  of  “helicopter  parents”  to  let  their  children  fail, 
exercise  independence,  or  suffer  from  low  self-esteem,  the  character 
traits  described  here  are  not  surprising.  Thus,  when  it  comes  to  the 
workplace,  as  Bruce  Tulgan  observes,  millennials  expect  “performance- 
based  compensation,  flexible  schedules,  flexible  location,  marketable 
skills,  access  to  decision  makers,  personal  credit  for  results,  a  clear 
area  of  responsibility,  and  the  chance  for  creative  expression.”10 
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The  distinctive  traits  attributed  to  millennials  are  not  restricted  to 
values  and  beliefs.  An  increasing  number  of  scientific  studies  are  ex¬ 
amining  the  impact  of  technology  usage  (gaming,  Internet,  etc.)  on 
the  brain  and  finding  that  millennials — particularly  those  frequently 
engaged  with  technology — have  altered  brain  wiring  and  chemis¬ 
try.11  Thus,  to  dismiss  the  notion  that  millennials  are  different  is  to 
discard  a  wealth  of  social  scientific  and  neurological  evidence  that 
suggests  otherwise. 

Maturational  Theory  versus  Generational  Theory 

For  those  who  remain  skeptical  of  suggestions  that  millennials  are 
fundamentally  dissimilar  to  members  of  previous  generations,  a  brief 
overview  of  maturation  and  generational  theories  may  be  useful.  In 
examining  the  two,  we  can  distinguish  between  what  can  be  expected 
of  individuals  as  they  move  through  the  natural  stages  of  life  (child¬ 
hood,  adolescence,  adulthood,  marriage,  family,  etc.)  and  what  is 
unique  from  one  generation  to  the  next. 

Maturational  theory  examines  how  individuals  change,  mature, 
and  develop  their  values,  attitudes,  and  preferences  as  a  function  of 
age.12  Examples  of  such  maturational  issues  are  numerous.  Young 
adults,  for  instance,  tend  to  be  more  politically  liberal  than  senior 
citizens.13  Studies  suggest  that  as  Americans  age,  they  tend  to  become 
more  conservative  in  their  outlook.14  This  shift  in  political  views  il¬ 
lustrates  a  maturational  issue.  In  the  workplace,  maturational  issues 
play  an  important  role  in  shaping  the  behavior  of  employees.  For  ex¬ 
ample,  as  individuals  marry,  have  children,  and  purchase  a  house, 
they  tend  to  be  more  interested  in  workplace  stability  and  are  there¬ 
fore  less  likely  to  change  employers.15  These  maturational  issues  are 
juxtaposed  against  generational  issues. 

Just  as  maturational  theory  seeks  to  explain  how  the  values  and 
beliefs  of  individuals  develop  during  a  lifetime,  so  does  generational 
theory — first  developed  by  German  sociologist  Karl  Manheim — seek 
to  explain  how  external  events  and  circumstances  shape  attitudes  and 
values.16  Defined  as  a  group  that  shares  birth  years  and  significant  life 
events,  a  generation  (age  cohort)  often  has  a  common  set  of  attitudes  or 
beliefs  distinctly  different  from  that  of  previous  or  later  generations.17 
Shared  influential  economic,  political,  social,  and  technological 
events — such  as  the  Great  Depression,  World  War  II,  the  Civil  Rights 


80  UNDERSTANDING  THE  IMPACT  OF  MILLENNIALS 


Movement,  and  the  prevalent  use  of  the  cell  phone — shape  genera¬ 
tional  beliefs  and  attitudes.  Experiencing  such  events  at  a  formative 
age  (usually  as  preteens/teens  and  young  adults)  particularly  affects  a 
cohort’s  worldview  and  approach  to  living  within  society  (cohort  ef¬ 
fects).  As  Managing  the  Millennials  indicates,  “Each  age  cohort  tends 
to  develop  its  own  characteristic  patterns  of  attitudes  and  expecta¬ 
tions  about  what  is  and  is  not  possible  to  achieve  in  life,  about  what  is 
good  and  what  is  bad,  and  about  whom  to  trust  and  what  to  fear.”18 

Thus,  as  people  grow  up  and  grow  old  together,  all  while  the  sur¬ 
rounding  sociological  structure  around  them  is  changing,  interplay 
occurs  between  these  events  and  the  attitudes  and  values  of  those 
experiencing  them.19  In  short,  suggesting  that  as  millennials  age  they 
will  share  the  same  values  as  their  boomer  and  Xer  bosses  is  only 
partially  correct.  Although  they  will  share  some  characteristics  as 
they  build  families  and  careers,  millennials  will  also  have  values  and 
beliefs  distinctly  different  from  those  of  their  predecessors. 

Traditionalists,  Boomers,  and  Xers 

Before  recommendations  to  effectively  recruit,  train,  retain,  and 
manage  millennial  Airmen  are  suggested,  the  following  briefly  describes 
three  generations  that  preceded  the  millennials.  Some  of  the  issues  that 
distinguish  one  generation  from  another  thus  become  apparent. 

Traditionalists  (1900-45) 

Born  between  1900  and  1945,  traditionalists  were  most  influenced 
by  defining  events  such  as  the  Great  Depression,  the  New  Deal,  World 
War  II,  and  the  Korean  War.  Aphorisms  like  “save  for  a  rainy  day”  and 
“waste  not  want  not”  aptly  apply  to  this  generation.  If  one  character¬ 
istic  best  captures  this  group’s  view  toward  work,  it  would  be  loyalty. 
God-fearing,  hard-working,  patriotic,  conformist,  socially  and  finan¬ 
cially  conservative,  and  rigid,  traditionalists  expected  to  spend  an 
entire  career  with  the  same  company,  from  which  they  would  one  day 
retire  and  draw  a  pension.20 

Baby  Boomers  (1946-64) 

With  close  to  80  million  baby  boomers — twice  the  number  of 
traditionalists — this  generation  is  quite  large.  Heavily  influenced  by 
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the  Vietnam  War;  Civil  Rights  Movement;  assassinations  of  John  F. 
Kennedy,  Martin  Luther  King,  and  Robert  Kennedy;  and  Watergate, 
baby  boomers  grew  to  be  workaholic,  idealistic,  materialistic,  self- 
focused,  and  competitive.  They,  too,  sought  to  spend  a  career  in  a 
single  company.  However,  they  were  not  content  to  have  a  secure  posi¬ 
tion  but  strived  to  make  their  way  to  the  top  of  the  corporate  ladder.21 
The  baby  boomer  generation  dominates  the  top  ranks  of  politics  and 
business,  but  this  hierarchy  will  soon  change  as  boomers  retire  and 
Xers  take  their  place. 

Xers (1965-80) 

The  smallest  group  of  the  four  generations,  Xers  grew  to  adulthood 
on  the  cusp  of  the  greatest  technological  revolutions  (computing, 
communications,  the  Internet)  in  history.  Although  the  millennials 
have  never  known  a  time  without  cell  phones,  the  Internet,  laptops, 
social  media,  and  Skype,  the  Xers  were  still  young  enough  to  be  com¬ 
fortable  with  these  technological  developments  and  were  often  early 
adopters.  Often  called  the  “latchkey  kids,”  Xers  have  values  and  be¬ 
liefs  shaped  by  events  such  as  the  AIDS  epidemic,  Challenger  space 
shuttle  disaster,  fall  of  the  Berlin  Wall,  Oklahoma  City  bombing,  and 
Bill  Clinton-Monica  Lewinsky  scandal.  This  generation  is  often  de¬ 
scribed  as  skeptical,  self-reliant,  cynical,  distrustful  of  authority,  re¬ 
sourceful,  and  entrepreneurial.  Unlike  millennials,  Xers  prefer  work¬ 
ing  independently  rather  than  in  teams.  As  Ron  Alsop  notes,  “Xers 
don’t  trust  institutions  and  don’t  expect  job  security.”22  They  were  the 
first  generation  to  watch  their  parents  devote  their  lives  to  a  company, 
spending  long  days  away  from  their  families  only  to  get  laid  off  before 
that  dedication  reaped  a  clear  reward.  Influenced  by  such  experi¬ 
ences,  this  generation  was  the  first  that,  on  a  large  scale,  desired  to 
create  a  “work-life  balance”  wherein  total  commitment  to  the  job  of¬ 
ten  came  second  to  family  concerns.23 

This  deviation  from  a  long-standing  cultural  norm  (devotion  to 
work)  is  even  more  deeply  ingrained  in  millennials,  who  are  increas¬ 
ingly  seeking  ways  to  make  work  fit  their  lifestyle  rather  than  the  other 
way  around.  For  the  Air  Force,  this  preference  for  flexibility  and  the 
ability  to  switch  jobs  frequently  may  prove  problematic  when  recruit¬ 
ing,  training,  retaining,  and  managing  millennials.  However,  the  fol¬ 
lowing  strategies  can  improve  the  service’s  success  in  these  areas. 


82  UNDERSTANDING  THE  IMPACT  OF  MILLENNIALS 


Adapting  to  Millennial 

The  weight  of  evidence  suggests  that  the  millennial  generation  varies 
from  preceding  generations  in  ways  that  are  proving  challenging  to 
their  boomer  and  Xer  bosses.  However,  the  Air  Force  has  the  opportu¬ 
nity  to  utilize  its  natural  advantages,  while  also  undertaking  modest 
changes  in  approach,  to  maximize  its  use  of  limited  human  resources. 
With  that  objective  in  mind,  we  offer  the  following  recommendations. 

Recruiting 

According  to  a  KEYGroup  survey,  health  benefits,  work-life  bal¬ 
ance,  and  promotion  opportunities  are  the  top  three  motivators  for 
millennial  when  they  choose  an  employer.  Surprisingly,  salary  came 
in  21st  in  importance.24  This  news  is  very  good  for  the  Air  Force.  Al¬ 
though  health  care  has  long  been  a  draw  for  Americans  interested  in 
joining  the  military,  its  rising  cost  and  recent  legislation  have  signifi¬ 
cantly  increased  the  desire  for  medical  insurance.  With  its  no-cost 
and  low-cost  health  care,  the  Air  Force  has  the  opportunity  to  appeal 
to  a  primary  desire  of  millennials  when  it  seeks  to  recruit  them.  Given 
the  Air  Force’s  structure,  the  service  also  has  the  opportunity  to  ap¬ 
peal  to  millennials’  desire  for  promotion.  For  the  average  enlisted 
member,  the  chances  of  being  promoted  in  rank  seven  or  eight  times 
(master  sergeant  or  senior  master  sergeant)  are  good.  For  an  officer, 
an  average  career  may  bring  four  to  six  promotions  in  rank.  Increased 
status  and  responsibility  may  also  accompany  higher  rank.  In  short, 
for  millennials,  who  are  impatient  for  advancement,  the  chances  for 
promotion  in  the  Air  Force  are  often  greater  than  those  in  the  private 
sector.25  The  Air  Force  should  highlight  both  points  as  it  attempts  to 
recruit  from  a  smaller  pool  of  qualified  18-to-24-year-old  millennials. 

More  than  any  previous  generation,  millennials  view  themselves 
as  citizens  of  the  world  rather  than  strictly  as  Americans.  Although 
this  outlook  may  naturally  seem  to  diminish  the  sense  of  patriotism 
that  is  a  hallmark  of  recruiting,  the  quality  and  number  of  recruits 
joining  the  US  military  in  the  post-9/1 1  era  are  better  than  ever.26  The 
Air  Force  can  improve  its  millennial  recruiting  by  appealing  to  the 
desire  of  young  Americans  to  promote  peace  and  security  more 
broadly  and  to  their  role  in  performing  that  function  as  an  Air  Force 
member.  The  service  should  not  change  its  maxims  to  appeal  to  mil¬ 
lennials,  but  emphasizing  its  larger  global  role  will  attract  a  more 
worldly  generation. 


UNDERSTANDING  THE  IMPACT  OF  MILLENNIALS  83 


Successfully  recruiting  the  best  and  brightest  millennials  will  de¬ 
pend  not  only  on  the  Air  Force’s  provision  of  health  care  and  promo¬ 
tion  opportunities  but  also,  to  a  large  extent,  on  its  ability  to  convince 
millennials  that  they  will  gain  useful  skills  in  the  service.27  With  mil¬ 
lennials  coming  of  age  during  a  decade  that  saw  a  recession  after  9/11 
and  the  “Great  Recession,”  young  people  are  particularly  concerned 
about  finding  a  job  and  developing  in-demand  skills.  Given  its  tech¬ 
nical  focus,  the  USAF  is  particularly  well  positioned  to  appeal  to  this 
desire.  In  many  respects,  the  highly  skilled  jobs  that  are  the  hallmark 
of  the  Air  Force  are  one  of  its  greatest  recruiting  tools.  This  natural 
advantage  is  more  important  now  than  perhaps  at  any  point  in  the 
past.  Taken  together,  the  USAF’s  inherent  characteristics  give  it  a  sig¬ 
nificant  edge  in  successfully  recruiting  millennials.  The  main  chal¬ 
lenge  will  come  in  effectively  crafting  its  message  to  highlight  those 
attributes  most  desirable  to  this  generation.  Thus,  the  unique  DOD 
mission  set  (Title  10)  is  attractive  to  millennials  and  should  be  lever¬ 
aged  in  recruitment  campaigns. 

Training 

The  term  “helicopter  parent”  was  created  to  describe  the  overinvolved, 
overprotective  parents  of  millennials.  One  real  result  of  this  parenting 
style  is  the  raising  of  the  generation  least  experienced  with  failure.  In 
many  respects,  the  desire  to  protect  millennial  children  from  the  re¬ 
alities  and  disappointments  of  life  has  left  them  ill  prepared  for  adult¬ 
hood.28  For  the  Air  Force,  this  conditioning  presents  a  particular 
challenge  when  training  Airmen  unaccustomed  to  being  told  they  are 
wrong  or  have  failed.  Whereas  previous  generations  were  more  likely 
to  accept  negative  feedback,  learn  from  their  mistakes,  and  adjust  their 
actions  to  attain  success,  millennials  are  much  more  likely  to  respond 
poorly  to  such  feedback,  become  despondent,  and  attempt  to  quit. 

Minimizing  washout  rates  and  maximizing  training  throughput 
will  require  an  adjustment  to  training  techniques  from  basic  military 
training  all  the  way  through  advanced  skills  training.  Throughout  the 
literature,  several  techniques  are  suggested  for  improving  the  quality 
of  training: 

•  Develop  an  effective  coaching  system. 

•  Give  constant  feedback. 
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•  Frame  discussions  of  performance  to  focus  on  building  the  re¬ 
quired  behavior  or  skill.29 

This  approach  may  seem  antithetical  to  the  demanding  and  rigorous 
approach  preferred  by  many  Airmen.  However,  if  the  objective  is  to 
train  an  operationally  effective  force,  these  techniques  are  useful  in 
accomplishing  these  objectives. 

Retaining 

In  many  respects,  the  organizational  characteristics  that  lead  to 
success  in  retention  are  not  significantly  different  from  those  for  re¬ 
cruiting.  Just  as  the  Air  Force’s  opportunity  for  regular  promotion  is 
certain  to  appeal  to  impatient  millennials  as  they  contemplate  join¬ 
ing,  so  is  it  certain  to  be  a  key  factor  in  their  retention.30  Thus,  maxi¬ 
mizing  the  opportunity  not  only  for  promotion  in  rank  but  also  for 
responsibility  and  authority  is  central  to  creating  an  environment 
where  millennials  see  their  trajectory  as  upward. 

Perhaps  most  important  to  retention  is  the  Air  Force’s  ability  to 
communicate  how  the  work  Airmen  perform  is  vital  to  the  larger 
national  security  mission.  Conveying  this  message  is  important  be¬ 
cause  millennials  have  repeatedly  identified  the  creation  of  “social 
capital”  as  the  single  most  important  aspect  of  work  when  it  comes  to 
determining  their  preferred  employer.  In  other  words,  they  have  a 
need  to  feel  that  their  work  is  more  than  just  a  paycheck;  it  must  con¬ 
tribute  to  the  “greater  good.”31  Because  no  previous  generation  has 
placed  as  much  importance  on  this  variable,  the  Air  Force  may  need 
to  emphasize  its  contribution  to  the  greater  good.  As  an  example  of 
this  sentiment  in  action,  the  current  retention  rate  of  Air  Force  of¬ 
fensive  cyber  operators  (17  series)  remains  above  95  percent  despite 
private  industry’s  willingness  to  pay  these  Airmen  two  or  three  times 
their  current  salaries.32  This  retention  rate  is  the  result  of  a  high  sense 
of  mission  importance. 

Creating  and  expanding  collaborative  work  environments — a 
natural  strength  of  the  military  as  a  whole — will  also  aid  in  improving 
retention  of  millennial  Airmen.  More  than  any  previous  generation, 
millennials  have  grown  to  adulthood  in  an  environment  where  they 
work  collaboratively,  both  in  person  and  remotely.  Fostering  a  culture 
of  teamwork  will  appeal  to  their  natural  preferences  and  bind  them  to 
fellow  Airmen,  both  of  which  will  help  improve  retention.33 
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Managing 

Effective  strategies  for  managing  millennial  is  a  final  area  that 
deserves  discussion.  Indeed,  managers  from  the  boomer  and  Xer 
generations  can  become  most  frustrated  with  their  millennial  subor¬ 
dinates.  Three  recommendations  may  be  particularly  helpful. 

Given  their  familial  and  social  experiences  growing  up,  millenni- 
als  respond  best  to  managers  who  employ  a  transformational  leader¬ 
ship  style.34  These  managers  are  charismatic,  inspirational,  and  intel¬ 
lectually  stimulating,  showing  individual  consideration  for  their 
subordinates.  This  style  is  opposed  to  transactional  leadership 
whereby  a  manager  identifies  requirements  of  a  subordinate  and,  in 
return  for  accomplishing  specified  tasks,  rewards  him  or  her  upon 
their  completion.  Although  transactional  leaders  are  more  acceptable 
to  and  preferred  by  previous  generations,  such  is  not  the  case  with 
millennials.  Thus,  developing  Airmen  leaders  with  the  skills  to  em¬ 
ploy  a  transformational  style  of  leadership  will  aid  the  service  in  maxi¬ 
mizing  the  effective  management  of  Airmen. 

Managers  will  also  be  called  upon  to  provide  much  more  frequent 
feedback  to  millennial  Airmen  than  is  currently  the  norm.  Millenni¬ 
als  have  grown  up  in  an  environment  where  they  received  constant 
encouragement  and  mentoring  from  their  parents  and  teachers.  Con¬ 
sequently,  the  contents  of  the  annual  officer/enlisted  performance 
report  is  inadequate  feedback.35  Even  the  standard  midterm  counsel¬ 
ing  will  be  viewed  as  too  little,  too  late.  Rather,  feedback  through  in¬ 
formal  means  should  occur  as  millennials  take  on  new  tasks  or  com¬ 
plete  projects.  The  combination  of  regular  feedback  and  mentoring 
will  ensure  that  millennials  understand  whether  they  are  meeting 
expectations  and  what  they  can  do  to  improve  their  performance. 

Finally,  the  impatience  of  millennials — discussed  previously — 
places  an  added  requirement  on  managers.  Millennials  have  a  strong 
expectation  that  they  will  be  provided  a  clear  path  to  success  and 
promotion.36  Although  many  managers  may  see  such  assumptions  as 
unreasonable,  giving  millennials  requisites  for  career  advancement 
and  professional  success  promotes  not  only  the  effective  management 
of  subordinates  but  also  retention  through  higher  job  satisfaction. 
For  the  Air  Force,  both  of  these  outcomes  are  increasingly  important 
as  fiscal  constraints  place  additional  responsibilities  on  every  Airman. 
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Summary 

While  the  above  recommendations  pertain  to  more  than  just  the 
millennial  generation,  they  have  been  identified  as  particularly  im¬ 
portant  to  a  generation  that  varies  significantly  from  those  that  came 
before  it.  For  the  Air  Force,  much  of  what  has  been  outlined  here  is 
designed  to  aid  leaders  in  the  effective  recruiting,  training,  retaining, 
and  managing  of  millennials.  Carrying  out  these  actions  is  no  small 
task.  The  need  to  address  issues  that  arise  as  one  generation  interacts 
with  another  is  nothing  new.  Effectively  adjusting  to  the  beliefs  and 
values  of  the  incoming  generation  is  always  important  to  an  organi¬ 
zations  success.  The  same  is  true  of  the  Air  Force  as  it  attempts  to 
build  a  cyber  force  unparalleled  in  its  ability  to  fight  and  win  the  na¬ 
tions  wars  in  cyberspace. 

In  recruiting  and  retaining  millennials,  the  Air  Force  can  capitalize 
on  several  dynamics.  Gaining  social  capital  is  important  to  millennials. 
The  idea  that  they  are  doing  something  for  the  greater  good  is  a  key 
factor  for  them  in  terms  of  job  satisfaction.37  The  mission  of  the  Air 
Force  is  ideal  for  such  a  mind-set  and  can  be  leveraged  into  its  re¬ 
cruitment  campaigns.  The  Air  Force  must  also  educate  the  upwardly 
mobile-minded  about  their  promotion  potential  and  grow  these  indi¬ 
viduals  through  mentoring  and  developmental  opportunities.  Com¬ 
bined  with  benefits  like  comprehensive  medical  care,  the  integration 
of  millennial  values  into  leadership  and  recruitment  practices  will 
enhance  the  Air  Forces  ability  to  gain  and  retain  the  talent  it  needs 
from  this  cohort  and  continue  to  dominate  its  chosen  domains. 


Recommendations  Summary 

•  The  USAF  should  highlight  its  health-care  benefits  and  high  promotion 
potential  as  it  attempts  to  recruit  from  a  smaller  pool  of  qualified  18-to- 
24-year-old  millennials. 

•  The  USAF  can  improve  its  millennial  recruiting  by  appealing  to  the  desire 
of  young  Americans  to  promote  peace  and  security  more  broadly  and  their 
role  in  performing  that  function  as  a  USAF  member.  Given  its  technical 
focus,  the  USAF  is  particularly  well  positioned  to  appeal  to  this  desire. 

•  In  many  respects,  the  highly  skilled  jobs  that  are  the  hallmark  of  the  USAF 
are  one  of  its  greatest  recruiting  tools.  The  unique  DOD  mission  set  (Title 
10)  is  attractive  and  should  be  leveraged  in  recruitment  campaigns. 
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Chapter  5 

Force  Development 

Distinct  from  education  and  training,  the  development  of  cyber 
forces  is  defined  in  this  study  as  the  assignments  and  processes  by 
which  Airmen  in  a  cyber  or  cyber-related  AFSC  career  improve  their 
skills  over  time.  The  goal  of  force  development,  for  both  officer  and 
enlisted  personnel,  is  to  create  Airmen  who  can  lead  within  cyber 
teams  and  at  the  squadron,  group,  wing,  and  eventually  numbered  air 
force  (NAF)  or  MAJCOM  level.  This  goal  is  consistent  with  the 
CSAF’s  original  tasking  of  ensuring  that  our  force-development  con¬ 
structs  span  an  Airman’s  career.1 

The  concept  of  cyberspace  touches  a  wide  variety  of  career  fields, 
but  this  study  primarily  focused  on  development  of  the  five  AFSCs 
most  clearly  associated  with  cyber  systems:  the  officer  career  fields  of 
14N,  17D,  and  17S  and  the  enlisted  career  fields  of  1N4  and  1B4.  The 
authors  acknowledge  that  these  career  fields  comprise  approximately 
5  percent  of  the  broader  cyber  enterprise.2  We  begin  by  addressing  a 
couple  of  overall  issues  that  hamper  analysis  of  the  cyber  force  in 
general.  Next  we  explore  force  development  of  the  above  five  AFSCs. 
We  then  briefly  examine  the  3D-series  career  field  and  other  issues 
associated  with  force  development. 

This  study  found  three  key  overall  challenges  in  attempting  to  for¬ 
malize  cyber  force  development.  The  first  is  the  issue  of  cyber  hy¬ 
giene.  Although  our  new  accessions  were  born  and  raised  in  the  digi¬ 
tal  age,  they  do  not  intrinsically  understand  how  to  recognize 
malware,  phishing,  or  other  forms  of  attacks  that  can  turn  into  in¬ 
sider  threats.  Since  insider  threats  are  the  cause  of  most  breaches  of 
network  security,  it  is  imperative  that  new  recruits  and  accessions  be 
educated  to  the  analysis  level  of  Blooms  taxonomy  in  the  recognition 
and  response  to  cyber  threats.3  Every  Airman  must  be  a  cyber  de¬ 
fender,  able  to  recognize  and  respond  to  cyber  threats  and  to  under¬ 
stand  the  vulnerabilities  of  cyber.4  Instruction  in  cyber  hygiene  via 
computer  may  be  fine  for  annual  refresher  training  but  is  insufficient 
for  initial  security  training  for  Air  Force  personnel — the  opportunities 
for,  and  cost  of,  carelessness  are  substantial.  Awareness  of  how  our 
evolving  cyber  requirements  fit  into  each  member’s  day-to-day  military 
life  and  how  the  various  domains  interact  will  become  increasingly 
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important  in  the  coming  years.  This  training  requirement  applies  to 
Air  Force  senior  leadership  as  well.  As  TTPs  evolve  rapidly  in  this 
domain,  leaders  must  stay  abreast  of  these  changes  to  ensure  that  the 
Air  Force  provides  its  best  cyber  effects  to  defend  the  nation.5  The 
avenue  of  choice,  however,  for  staying  current  as  a  leader  in  this  field 
is  growing  up  in  or  immersion  in  it.6  This  study  recommends  that  a 
short  course  in  cyber  hygiene  that  achieves  analysis-level  learning 
objectives  in  cyber  information  assurance  operations  be  included  as 
part  of  all  accessions  programs  (Basic  Military  Training  [BMT],  Of¬ 
ficer  Training  School  [OTS],  US  Air  Force  Academy  [USAFA],  and 
Reserve  Officer  Training  Corps  [ROTC])  (Office  of  Primary  Respon¬ 
sibility  [OPR]:  AETC,  USAFA,  Air  Force  CIO). 

Second,  the  Air  Force  has  continuous  difficulty  with  both  defining 
the  cyber  enterprise  and  determining  who  is  and  is  not  in  cyber.  Follow- 
on  studies  should  look  closely  at  the  cyber  intelligence  collection  field 
(1N2)  and  dive  more  deeply  into  the  enlisted  3DXX  career  field  set. 
For  reasons  described  next,  much  work  also  needs  to  be  done  with 
regard  to  developing  cyber  civilians. 

The  third  major  current  challenge  in  cyber  force  development  is 
that  the  USAF  cannot  track  its  civilians  who  are  part  of  the  cyber 
domain.  This  study  found  that  many  civilians  working  national-level 
cyber  problems  do  not  have  a  cyberspace  civilian  occupational  spe¬ 
cialty  (COS)  identifier.7  Some  civilians  were  transplanted  to  cyber 
units  but  retained  their  initial  COS,  resulting  in  the  AFPC’s  analysis 
division  being  unable  to  identify  civilians  presently  in  cyberspace  bil¬ 
lets.8  Further,  in  tracking  civilian  cyber  operators,  virtually  all  cyber¬ 
space  duties  are  placed  in  a  single  occupational  series  (2210)  basket, 
making  it  currently  impossible  to  parse,  analyze,  or  categorize  spe¬ 
cific  civilian  specialties  within  the  Air  Force  structure.9 

The  DHS  is  leading  a  whole-of-government  effort  to  address  the 
categorization  problem,  but  OPM  is  not  scheduled  to  complete  re¬ 
classification  of  the  cyber  civilian  workforce  until  at  least  20 18. 10  The 
eventual  goal  is  to  put  civilians  into  seven  groups  of  cyberspace- 
related  duty  codes  standardized  across  all  government  agencies  in  ac¬ 
cordance  with  the  National  Initiative  for  Cybersecurity  Education. 
When  fielded,  this  framework  will  form  the  basis  for  civilian  force 
development.11  Until  then,  however,  laying  out  a  force  development 
structure  for  the  2200-series  civilian  career  field  would  likely  be  over¬ 
come  by  events  prior  to  its  completion.  Thus,  this  study  recommends 
that  while  the  USAF  continues  to  work  with  the  DHS  in  implementing 
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the  NICE  framework,  it  should  not  undertake  wholesale  changes  to 
the  2210  COS  until  the  framework  is  finalized  (OPR:  HAF/A6S 
[Cyberspace  Strategy  and  Policy]). 

14N  Intelligence  Officer 

The  four  Air  Force  AFSCs  for  the  officer  intelligence  career  field 
are  variants  of  the  basic  14N  designation.  A  14N1  is  an  entry-level 
officer  not  yet  considered  a  subject  matter  expert  in  any  of  the  six 
intelligence  disciplines  (geospatial  intelligence  [GEOINT],  human 
intelligence  [HUMINT],  measurement  and  signature  intelligence 
[MASINT],  open  source  intelligence  [OSINT],  signals  intelligence 
[SIGINT],  or  technical  intelligence  [TECHINT].12  However,  there  is 
no  cyber  intelligence  officer  discipline  and  no  differentiation  among 
these  disciplines  in  the  AFSC  designation.13  The  remaining  three  AFSCs 
include  a  14N2,  which  represents  an  individual  with  an  “intermediate” 
level  of  qualification  in  at  least  one  of  the  above  six  disciplines;  a 
14N3,  a  highly  qualified  individual  in  at  least  one  of  the  six  disciplines; 
and  a  14N4,  the  AFSC  awarded  to  those  who  serve  on  a  MAJCOM  or 
equivalent  staff  and  oversee  one  or  more  of  these  sub  specialties. 14 
Again,  the  AFSC  does  not  distinguish  among  the  disciplines  that  an 
Airman  has  mastered. 

This  study  was  initially  concerned  with  the  lack  of  tracking  of  ex¬ 
pertise  within  these  six  disciplines  of  the  intelligence  career  field  and 
the  inability  to  deliberately  use  or  develop  an  Airmans  expertise.  To 
address  this  issue,  in  2014  HAF/A2  (Intelligence)  used  a  career  path 
management  tool  to  manually  complete  the  coding  of  the  duty  history 
records  of  approximately  30,000  Airmen.  This  tool  uses  a  six-digit 
identifier  that  includes  in  its  coding  the  organizational  level,  disci¬ 
pline,  and  duties  that  the  individual  performed  during  each  separate 
work  assignment.  It  can  be  used  for  tracking  these  disciplines  as  well 
as  several  other  aspects  of  an  Airmans  career.  However,  at  present  this 
study  finds  that  the  AFPC  is  not  using  this  tool  and  its  associated 
coding  in  the  assignment  of  Airmen  in  the  intelligence  career  field. 

The  research  team  encountered  many  members  unable  to  find  Air 
Force-level  guidance  regarding  management  of  this  career  field.  The 
AFPC-hosted  web  page  for  the  14N  career  field  has  the  headline 
“This  page  is  your  primary  link  to  personnel  actions  affecting  your 
career,  future  opportunities  and  your  personal  development  within 
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your  specialty.”  Yet  this  “home”  for  all  personnel  management  of  all 
four  components  of  the  14N  career  field  is  nearly  devoid  of  content.15 
The  14XX  Intelligence  Officer  Assignment  Team  does  maintain  a 
separate  website  outside  the  myPers  portal  (on  the  Air  Force  portal) 
that  contains  the  career-management  guide,  information  on  force- 
management  actions,  and  guidance  for  intelligence  officers  in  planning 
their  career  progression.  Anecdotally,  however,  the  research  team 
found  that  many  officers’  lack  of  awareness  of  the  existence  of  this 
other  site  resulted  in  significant  confusion  among  some  14N  officers 
regarding  how  their  career  is  being  managed.  This  study  concludes 
that  the  USAF  has  failed  to  properly  communicate  to  the  members  of 
the  14N  career  field  the  plan  for  their  management.  This  study  rec¬ 
ommends  building  a  robust  14XX  website  for  the  14N  career  field 
maintained  by  Headquarters  (HQ)  AFPC  and  clearly  communicat¬ 
ing  that  website’s  location  to  the  field  (OPR:  HAF/A2  and  AFPC).16 

In  attempting  to  clarify  how  14N  officers  are  developed,  the  re¬ 
search  team  met  with  AFSPC  leadership;  the  Air  Force  Intelligence, 
Surveillance,  and  Reconnaissance  Agency  (AFISRA);  HAF/A2;  HAF/ 
A3  (Operations);  and  HAF/A6  (Communications).  We  found  career 
management  guidance  dispersed  across  this  set  of  agencies.  AFSPC 
maintains  a  cyber  career-management  road  map  but  does  not  own 
the  cyberspace  14N  officer  corps.  That  corps  is  owned  by  Twenty- 
Fifth  Air  Force  (formerly  known  as  AFISRA),  which  resides  with  Air 
Combat  Command  (ACC).17  The  road  map  states  that  this  is  only 
“the  AFSPC  plan  for  development  of  intelligence  professionals  within 
the  Cyberspace  domain”  and  that  implementation  of  this  plan  “will 
require  close  coordination  between  AFSPC,  HAF/A2,  AFISRA  and 
Air  Combat  Command.”18  Before  becoming  Twenty-Fifth  Air  Force, 
AFISRA  also  compiled  products  that  discuss  various  aspects  of  re¬ 
cruiting,  retaining,  educating,  training,  and  developing  our  intelli¬ 
gence  forces.19  The  totality  of  these  documents  suggests  that  the  man¬ 
agement  of  our  14N  community,  and  perhaps  the  1N4  cyberspace 
community,  has  not  been  conducted  on  a  corporate  basis  but  at  lower 
levels.  The  decision  to  move  AFISRA  as  Twenty-Fifth  Air  Force  un¬ 
der  ACC  seems  to  make  this  management  model  more  complex  and 
provides  further  justification  for  moving  management  of  the  14N  cy¬ 
berspace  intelligence  officers  to  the  USAF  corporate  level.  Although 
acknowledging  that  this  process  is  under  way,  this  study  recommends 
that  the  functional  manager  for  the  14XX  career  field  consolidate  all 
documents  and  management  of  the  career  field  at  the  corporate 
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USAF  level  and  work  with  AFPC  to  publish  the  appropriate  Air 
Force-level  guidance  (OPR:  HAF/A2,  AFPC). 

For  14N  career  fields,  current  recruiting  is  for  personnel  with  a 
STEM  background.20  Nevertheless,  only  2.9  percent  of  14N  officers 
have  a  scientific  degree  relating  to  cyberspace,  and  roughly  two- 
thirds  have  degrees  outside  the  hard  sciences.21 

Initial  Air  Force  training  of  the  14N  career  field  occurs  through 
the  Intelligence  Officer  Course  taught  by  the  17th  Training  Wing 
(TW)  at  Goodfellow  AFB,  Texas.22  The  course  is  a  broad  overview  of 
the  intelligence  career  field  and  includes  separate  blocks  that  touch 
on  each  of  the  intelligence  disciplines  and  functional  competencies. 
At  the  expense  of  this  breadth,  the  syllabus  is  not  particularly  deep  on 
any  one  topic.  The  cyberspace  segment  of  the  course  seems  remark¬ 
ably  shallow  and  lasts  less  than  two  days.23  To  put  this  situation  in 
perspective,  the  14N  training  course  is  taught  over  a  six-month  pe¬ 
riod,  for  a  total  of  1,049.5  hours  of  instruction.24  By  comparison,  the 
air  block  course  of  instruction — Air  Forces,  Surface-to-Air  Forces, 
and  Integrated  Air  Defense  Systems  (IADS) — lasts  four  weeks  (174 
hours  of  instruction)  during  the  same  six-month  training  program.25 
This  study  recognizes  the  need  for  the  Intelligence  Officer  Course  to 
span  the  intelligence  field  and  those  missions  in  which  the  majority 
of  14Ns  will  serve,  but  the  limited  duration  of  the  cyberspace  seg¬ 
ment  was  surprising.  Therefore,  the  team  recommends  that  the  intel¬ 
ligence  community,  including  Twenty-Fifth  Air  Force,  reexamine  the 
intelligence  training  course  to  determine  if  recent  events  in  cyber¬ 
space  warrant  adjustment  of  its  content  and  reallocation  of  time 
across  the  various  intelligence  disciplines  and  competencies  (OPR: 
17th  TW,  AETC/A3  (Operations),  Twenty-Fifth  Air  Force,  HAF/A2). 

Each  class  includes  approximately  19  officers,  with  several  classes 
conducted  at  one  time,  and  fills  only  a  few  cyber  positions.  Further, 
no  concrete  criteria  for  cyber  assignments  come  out  of  Goodfellow. 
The  training  wing  has  an  assignment-selection  process;  however, 
since  cyber-related  instruction  lasts  only  two  days,  it  is  difficult  to 
make  an  accurate  assessment  for  a  cyber  assignment  in  a  broad  over¬ 
view  course.  The  process  includes  test  scores,  STEM  concentrations 
in  undergraduate  school,  student  wishes,  and  instructor  inputs  to 
help  determine  a  students  aptitude  for  a  follow-on  cyber  assignment.26 

It  might  prove  useful  to  work  toward  training  coordination  /  syn¬ 
chronization  from  initial  school  to  end  assignment.  Although  many 
courses  are  zero-sum  options  (something  goes  in  /  something  comes 
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out),  given  the  intelligence  community’s  dependence  on  cyber,  addi¬ 
tional  cyber  instruction  time  and  content  should  be  added  to  the 
course.  Strengthening  cyber  instruction  for  14Ns  calls  for  more 
hands-on  training,  and  cyber  should  play  a  more  significant  role  in 
class  exercises. 

Follow-on  training  for  14Ns,  if  any,  is  determined  by  their  gaining 
unit  or  command.  It  is  more  likely  they  will  receive  on-the-job  train¬ 
ing  (OJT)  for  their  role  at  that  particular  unit.  If  selected  for  duty  in 
support  of  USCYBERCOM,  officers  receive  over  a  year’s  worth  of 
training  before  being  able  to  conduct  ISR  in  the  cyber  domain.27  For 
personnel  on  a  national  mission  team  (NMT),  both  OJT  and  training 
last  nearly  three  years  before  the  member  is  fully  mission  qualified.28 
At  some  point  later  in  their  careers,  14N  officers  may  attend  the  Cy¬ 
ber  200  or  300  courses,  which  have  a  hacking  bent.29  Since  the  de¬ 
mand  for  hacking- capable  intelligence  analysts  is  relatively  small, 
only  10  to  20  attend  each  year. 

As  stated  above,  despite  HAF/A2  having  coded  its  Airmen  using 
the  career-path  management  tool,  neither  the  MAJOMs  nor  AFPC 
yet  use  it  to  manage  assignments.  The  14N  officers  who  spend  this 
extensive  period  in  training  do  not  necessarily  receive  a  special  expe¬ 
rience  identifier  and  thus  may  not  have  their  specialized  expertise 
tracked  by  the  corporate  USAF  process.30  A  subset  of  these  individu¬ 
als  eventually  has  a  personnel  record  annotation  for  specialized  cy¬ 
berspace  training,  and  these  are  the  officers  selected  for  the  Com¬ 
puter  Network  Operations  Development  Program  (CNODP).  These 
officers  incur  a  three-year  active  duty  service  commitment,  but  much 
of  this  time  is  spent  in  training — including  a  System  and  Network 
Interdisciplinary  Program,  Global  Network  Exploitation  and  Vulnera¬ 
bility  Analyst  Development  Program,  and  Computer  Network  Ex¬ 
ploitation  program — followed  by  OJT.31  Depending  on  the  student, 
this  program  can  take  between  12  and  18  months  to  complete,  and 
while  training  records  are  annotated  with  program  completion,  no 
special  experience  identifier  is  awarded  for  CNODP  completion.32 
Cyber-skilled  officers  are  manually  tracked  at  both  Twenty-Fourth 
and  Twenty-Fifth  Air  Forces.  However,  the  lack  of  SEIs,  combined 
with  a  general  preference  to  broaden  officers  in  the  14N  career  field 
as  they  are  groomed  for  future  leadership  positions,  can  and  does 
lead  to  AFPC  selecting  some  officers  for  only  one  tour  in  cyberspace 
prior  to  moving  them  to  other  intelligence  specialties.33  This  assignment 
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process  creates  a  training  demand  signal  of  up  to  two  man-years  to 
replace  their  expertise.34 

The  lengthy  training  pipeline  to  acquire  specialized  cyber  skills 
leads  this  study  to  conclude  that  highly  experienced  cyberspace  14N 
officers  should  be  specially  managed  as  a  resource.  The  value  of  doing 
so  is  already  mentioned  in  the  AFSPC  road  map.35  Acknowledging 
that  changes  in  this  direction  are  already  under  way,  this  study  rec¬ 
ommends  that  cyberspace  14Ns  be  assigned  a  minimum  of  two — 
preferably  three — back-to-back  cyberspace  tours  before  career 
broadening  into  other  areas  to  reduce  the  training  demand  and  create 
more  highly  experienced  cyberspace  intelligence  officers. 

The  research  team  acknowledges  that  HAF/A2  will  be  tracking 
these  14Ns  via  the  career  path  tool,  but  it  finds  that  AFPC  would  be 
the  better  place  for  career  tracking  to  occur.  That  these  officers’  skill 
sets  are  special  is  already  reflected  in  the  fact  that  a  tracking  mecha¬ 
nism  exists  at  the  NAF  and  AFSPC  levels.  However,  because  the  ca¬ 
reer  path  tool  is  not  currently  in  active  use  at  AFPC,  this  study  rec¬ 
ommends  that  these  officers  be  given  an  SEI  that  tracks  this  specialized 
expertise  and  makes  it  easier  for  the  assignment  system  to  manage 
them  as  the  specialized  resource  they  are  (OPR:  HAF/A2,  Twenty- 
Fifth  Air  Force,  and  AFPC).36 

Advancement  to  higher-level  14N  AFSCs  requires  additional  edu¬ 
cation,  experience,  and  training.  To  receive  the  intermediate  AFSC  of 
14N2,  entry-level  officers  must  complete  initial  and  mission  qualifi¬ 
cation  training  for  at  least  one  ISR  functional  competency,  complete 
the  distributed-learning  Intermediate  ISR  Skills  Course  (ISR  200), 
serve  for  a  minimum  of  12  months  performing  intelligence  func¬ 
tions,  and  be  recommended  by  their  supervisor.  Advancement  to  the 
fully  qualified  AFSC  14N3  requires  advanced  skills  training  in  their 
original  specialty  or  qualification  in  a  second  ISR  specialty,  comple¬ 
tion  of  ISR  300,  six  years  of  commissioned  experience  in  the  intelli¬ 
gence  career  field,  and  a  recommendation  by  their  supervisor.37 

Building  on  existing  14N  career  field  documents,  this  study  pro¬ 
poses  formalizing  a  construct  for  14N  development  for  those  officers 
who  eventually  develop  a  specialization  within  the  domain  of  cyber¬ 
space,  perhaps  along  the  lines  of  the  diagram  in  figure  10.  All  such 
officers  would  enter  the  intelligence  career  field  via  intelligence  offi¬ 
cer  school.  Officers  may  begin  in  any  of  the  intelligence  specialties 
after  completing  their  initial  training.  At  some  point  early  in  their 
career — ideally  not  later  than  their  second  assignment — officers  receive 
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their  first  posting  to  a  cyber  unit.  If  this  unit  is  at  the  national  level, 
then  extensive  USCYBERCOM  qualification  training  will  be  neces¬ 
sary;  successful  completion  of  that  training  and  the  Cyber  Intelli¬ 
gence  Follow-on  Training  Unit  (CIFTU)  course  by  these  officers  will 
earn  them  the  cyberspace  SEI.  Completion  of  the  CNODP  would  be 
highly  desired  at  this  time.  Due  to  the  rapid  evolution  of  the  cyber¬ 
space  domain,  combined  with  the  training  requirements  to  operate 
in  this  domain,  career  management  should  default  to  a  minimum  of 
two — ideally  three — back-to-back  tours  in  cyber-related  duty.38  Offi¬ 
cers  who  eventually  serve  more  than  two  tours  in  cyberspace-related 
operations  may  command  at  the  team  or  squadron  level  since  nearly 
half  of  the  commanders  for  operations  in  this  domain  are  expected  to 
come  from  the  intelligence  community.  Developmental  and  broad¬ 
ening  assignment  opportunities  for  field  grade  officers  will  exist  with 
joint  force  cyber  component  commanders  or  on  the  staffs  at  the  NAF, 
MAJCOM,  joint,  HAF,  or  NSA  levels.  As  was  first  pointed  out  in  the 
AFSPC  road  map,  a  cyber-centric  path  to  senior  command  is  now 
possible,  with  officers  potentially  commanding  at  team,  squadron, 
group,  and  wing  levels  without  the  traditional  broadening  across  the 
field  of  “INTs”  (intelligence)  that  has  historically  been  the  norm 
within  the  14N  community.39  It  is  important  to  note  that  the  number 
of  such  officers  will  likely  be  limited  by  the  few  groups  and  wings 
available  for  cyber-centric  commanders.  Officers  who  began  in  cyber 
and  have  completed  broadening  assignments,  taken  the  requisite 
professional  military  education  (PME)  courses,  and  shown  a  range  of 
skills  may  also  be  asked  to  serve  in  senior  positions  of  command  or  in 
senior  staff  positions  as  colonels. 

17  Series— Cyberspace  Warfare  and 
Network  Operations  Officers 

The  17-series  career  field  is  in  flux.  As  this  study  began,  cyber¬ 
space  operations  officers  were  classified  as  17DXAs  and  17DXBs.  On 
1  November  2014,  these  two  specialties  were  redesignated  as  17S 
(cyber  warfare  operations  officer)  and  17D  (network  operations  of¬ 
ficer),  respectively.40 

Personnel  holding  the  17D  AFSC  are  involved  in  establishing  cyber¬ 
space  systems,  providing  information  assurance,  and  defending  our 
fielded  infrastructure  and  mission  platforms.41  The  17D  designation  is 
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usually  reserved  for  individuals  assigned  to  Air  Force  wings,  groups, 
or  squadrons  and  are  the  cyber  forces  that  ensure  our  operational 
units’  ability  to  operate  both  in  garrison  and  in  the  field.  Officers  with 
the  17S  AFSC  work  in  cyberspace  defense  and  are  active  in  planning 
and  performing  active  network  defense  operations  in  support  of 
joint,  national,  and  Air  Force  objectives.42  The  17S  cyber  warfare  op¬ 
erations  officers  support  Air  Force  operations  at  the  network  level  and 
are  more  often  based  at  network  or  headquarters  operations  facilities 
not  collocated  with  our  operational  flying  units. 
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Figure  10.  Notional  14N  (cyber)  career  development  pyramid 

As  of  31  March  2014,  the  17-series  career  fields  had  2,459  authori¬ 
zations,  of  which  approximately  2,291  were  filled  (fig.  1 1  ).43  Slightly 
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more  than  one-fourth  of  the  assignments  were  in  joint  positions, 
with  AFSPC  and  AFISRA  accounting  for  30  percent  of  those  billets/ 
numbers.  The  rest  of  the  career  field  was  split  proportionally  across 
the  MAJCOMs.  As  of  this  writing,  the  designation  of  AFISRA  as 
Twenty-Fifth  Air  Force  will  result  in  the  ACC  slice  of  the  pie  increasing 
to  approximately  20  percent,  leaving  AFSPC  with  just  over  20  percent. 
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Figure  11.  Breakdown  of  the  17D  community  as  of  31  March  2014. 

(Reproduced  from  17D  Officer  Assignment  Team,  Cyberspace  Operations 
"Spread  the  Word"  briefing,  9-11  April  2014,  Lt  Col  Ross  Morrell,  17D 
assignments  chief,  HAF  Personnel  Center,  to  Dr.  John  P.  Geis  II,  AFRI, 
e-mail,  22  April  2014.) 

USCYBERCOM’s  current  demand  signal  will  require  the  17-series 
career  fields  to  grow  by  about  another  500  personnel  before  all  of  the 
proposed  expansion  of  the  national  mission  sets  is  complete.44  The 
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planned  final  demand  calls  for  2,943  17-series  career  officers,  requiring 
an  estimated  accession  of  219  per  year  to  sustain  the  field  at  current 
attrition  rates.45  Yet  A3C/A6C  (Cyberspace  Operations  and  Warf¬ 
ighting  Integration)  data  suggests  that  the  USAF  plans  to  access  only 
195  per  year,  and  AFPC’s  data  shows  a  major  shortfall  due  to  a  failure 
to  access  the  proper  number  of  17Ds  from  2010  to  2014  (fig.  12).46 
The  result  would  appear  to  be  the  creation  of  a  shortfall  that  will  hit 
the  Air  Force  in  a  few  years’  time.  This  deficit  may  be  exacerbated  by 
the  separation  of  136  computer  operations  professionals  under  the 
Enhanced  Selective  Early  Retirement  Board  process  that  concluded 
in  late  2014,  further  reducing  our  existing  force  structure.47 
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Figure  12.  Inventory  and  sustainment  of  17D  career  field  as  of  31 
March  2014.  (Adapted  from  Stephen  Losey,  "A  Leaner  Force:  Key  Changes 
Emerge  after  Tough  Year  of  Airman  Cuts,"  Air  Force  Times,  24  November 
2014,  http://www.airforcetimes.com/story/military/careers/2014/11/17/air-f 
orce-cuts-rank-afsc/1 91 61 847.) 

This  shortfall  could  come  concomitantly  with  an  economic  expan¬ 
sion  that  would  increase  Air  Force  attrition.  Recent  news  reports  sug¬ 
gest  that  the  corporate  sector,  both  domestically  and  abroad,  is  begin¬ 
ning  to  have  faith  in  the  ongoing  economic  recovery  and  will  soon 
resume  hiring  on  a  large  scale.48  This  study  finds  risk  that  an  improv¬ 
ing  economy  may  result  in  simultaneous  increases  in  attrition  and 
difficulty  in  accessing  officers,  particularly  through  OTS.49  Combined 
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with  the  need  to  grow  our  force,  an  economic  upswing  could  create 
an  extended  period  of  personnel  shortages  in  the  17-series  career 
fields.  This  study  recommends  that  these  trends  be  monitored  closely 
and  that  the  personnel  community  stand  ready  on  short  notice  to 
implement  retention  and  accessions  incentives  should  these  trends 
appear  and/or  heighten  (OPR:  A1  with  Offices  of  Collateral  Respon¬ 
sibility  [OCR]  of  A3C/A6C,  AFSPC,  and  Twenty-Fourth  Air  Force). 

For  officer  students,  many  of  whom  are  fresh  from  their  commis¬ 
sioning  source,  cyber  training  for  the  17S  career  field  is  a  lengthy 
process.  Officers  in  this  field  establish  cyber  systems,  conduct  informa¬ 
tion  assurance,  and  defend  cyber  infrastructures  and  platforms  at  the 
operational  level.50  Their  training  begins  with  115  days  of  instruction 
(920  academic  hours  or  approximately  24  weeks)  at  Keesler  AFB, 
Mississippi,  in  the  Undergraduate  Cyber  Training  course.  Designed 
to  meet  the  needs  of  the  Air  Force,  this  two-part  course  also  has  a 
joint  bent:  the  instruction  is  approximately  40  percent  Air  Force  spe¬ 
cific  and  60  percent  general  or  joint  training.  The  curriculum  teaches 
the  basics  of  what  a  cyber  force  member  needs  to  know;  however, 
more  time  may  be  needed  to  address  matters  beyond  the  rudimen¬ 
tary  level,  especially  given  the  rapid  rate  of  increasing  threats  to  the 
nations  networks. 

Cyber  has  both  art  and  science  aspects.  As  with  other  Air  Force 
specialties,  the  range  of  aptitudes  for  cyber-related  skills  is  broad. 
Some  personnel  enter  the  field  with  little  cyber  experience,  others 
have  taken  numerous  courses  in  college,  and  fewer  may  have  at¬ 
tended  cyber  camps.  Those  with  education  in  certain  areas — such  as 
EE,  CE,  and  CS — appear  to  do  quite  well  in  their  training.  The  art 
may  come  through  continual  exposure  to  and  practice  in  the  disci¬ 
pline  or  through  some  inborn  ability  or  aptitude  to  navigate  the  di¬ 
verse  tasks  required. 

Officers  who  attended  cyber  camps  or  completed  multiple  cyber- 
related  courses  in  college  have  arguably  learned  the  science  of  cyber. 
In  fact,  cyber-camp  training  relegates  much  of  the  basic  course  train¬ 
ing  to  an  elementary  level.  As  is  noted  in  the  chapter  on  cyber  educa¬ 
tion  and  training,  officers  who  attended  programs  such  as  the  Ad¬ 
vanced  Course  in  Engineering  or  Cyber  Security  Boot  Camp — a 
two-month  summer  program  for  junior  or  senior  ROTC  cadets  de¬ 
signed  to  develop  future  cybersecurity  officers — generally  excelled  in 
the  Undergraduate  Cyber  Training  (UCT)  program.51  To  continue 
this  trend,  we  recommend  fully  funding  the  AFIT/AFRL  distinct 
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ACE  programs  to  produce  more  of  these  highly  capable  cyber  officers 
(see  chap.  7).  We  also  recommend  that  a  “cyber  College  Level  Exami¬ 
nation  Program  (CLEP)”  exam  for  UCT  be  developed  for  individuals 
with  deeper  cyber  education  or  experience.  Doing  so  would  create 
additional  on-ramps  for  individuals  to  enter  the  program  and  poten¬ 
tially  help  avoid  repeated  training  for  officers  with  technical  degrees, 
such  as  those  in  CS,  CE,  and  EE.  Those  time  savings  could  shorten 
the  pipeline  for  some  individuals,  leaving  the  UCT  course  for  others 
without  the  requisite  education  or  experience. 

The  UCT  Phase  1  course  provides  training  to  personnel  in  the 
17D/S  AFSC  (table  3).  They  are  trained  under  the  provisions  of  the 
Air  Force  Security  Assistance  Program  in  the  knowledge  and  skills 
necessary  to  perform  duties  across  the  spectrum  of  the  cyberspace 
domain.  This  course  presents  an  introduction  to  cyberspace  domain 
fundamentals  and  operations;  doctrine  and  guidance;  organizations, 
roles,  and  responsibilities;  network  fundamentals/management;  and 
deployed  communications  systems.52 


Table  3.  UCT  Phase  1 


Introduction  to  cyber 
operations 

Deployed  operations 

Orientation 

Planning  military  operations 

Career  forces 

Deploying  organizations 

Cyber  organizations  and  mis¬ 

Developing  expeditionary  concepts 

sions 

for  posturing  and  deploying  Air  Force 

Domain  operations 

capabilities 

Mission  assurance 

Mobilizing  air  forces 

Continuity  of  operations 

Enterprise  networks 

Transmission  systems  and  fre¬ 
quency  spectrum 

Convergent  technologies 

Plans  and  programs 

Information  technology  systems 
DOD  cyber  fundamentals 

Deploying  cyber  systems 
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Table  3  ( continued ) 

Network  fundamentals 

DoD  8570.01  M  (Information 

Assurance  Workforce  Improvement 
Program)  Boot  Camp  and  Certification 

Network  fundamentals 

Security  concepts 

Cryptography  and  applications 

Infrastructure  security 

Security  in  transmission 

Operational  security 

Certification  testing 

Course  graduation  and  critique 

Adapted  from  81st  TW  Plan  of  Instruction  (POI),  Undergraduate  Cyber  Training 
(Phase  1),  E30QR17D1  0A1A,  22  October  2012. 


UCT  Phase  2  develops  the  foundation  from  Phase  1,  building  a 
strong  framework  of  specifics  necessary  to  protect  and  defend  a  com¬ 
puter  network  (table  4).  At  the  end  of  each  block,  as  with  the  1B4X1 
training,  students  have  an  opportunity  to  demonstrate  what  they 
learned  by  taking  a  written  test. 


Table  4.  UCT  Phase  2 


Cyber  surety 

Sensitive  compartmented  information 
facility  (SCIF)  orientation 

Information  assurance  and  cyber 
surety 

Certification  and  accreditation 

Security  tools  employment 
Confidentiality,  integrity,  and  authen¬ 
tication 

Standardization  and  evaluation 

Laws  and  ethics 

Federal  laws  governing  network 
monitoring 

International  and  operations  law 
Ethics,  regulations,  and  obligations 
Internet  regulatory  agencies  and 
coordination 

Attacking  and  exploiting  cyber 
networks 

Attacking  and  exploiting  cyber  net¬ 
works 

USAF  enterprise  operations 

Network  defense  operations 

Telephony  networking 

Telephony  networks 

Industrial  control  systems 

Industrial  control  networks 

Space  and  satellite  networks 

Satellite  and  space 
communications 

Battlefield  networks 

Integrated  air  defense  networks 
Combat  support  (command  and 
control  /  tactical  data  link  (TDL) 
networks) 
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Table  4  ( continued ) 

Cyber  network  threats  and 

Fighting  through  a  cyber  attack 

defense 

(capstone) 

Cyber  network  threats  and 

Fight  through  a  cyber  attack 

defense 

Course  graduation  and  critique 

Adapted  from  81st  TW  POI,  Undergraduate  Cyber  Training  (Phase  2),  E30BR17D1 
0A1A,  2  October  2012. 

Upon  graduation  from  UCT,  officers — like  1B4X1s — attend  the 
Intermediate  Network  Warfare  Training  (INWT)  course  at  the  39th 
Information  Operations  Squadron  (IOS)  for  eight  weeks  to  expand 
on  the  basic  skills  learned  at  Keesler.  In  addition,  the  39  IOS  cyber 
FTU  offers  weapons-system-specffic  initial  qualification  training 
(IQT)  for  two  to  four  weeks,  depending  on  the  system  training 
needed.  Officer  training  then  continues  with  mission  qualification 
training  at  the  gaining  unit.  The  entire  process  for  a  17S  to  become 
fully  mission  qualified  takes  at  least  66  weeks.53 

Some  officers  with  a  stronger  inclination  toward  or  aptitude  for 
the  requisite  skills  will  be  directed  to  the  (soon  to  be)  17S  AFSC  for 
cyberspace  defense.  Those  assigned  to  NMTs  complete  another  44 
weeks  of  coursework  and  OJT  administered  by  USCYBERCOM  be¬ 
fore  “flying  solo”  in  their  missions.54 

The  research  team  analyzed  accessions  of  cyberspace  officers 
through  OTS  during  periods  of  economic  growth.  In  the  most  robust 
years,  just  prior  to  the  recession  of  2007,  OTS  failed  to  recruit  any 
officers  in  the  highly  specialized  cyberspace  degree  programs.55  The 
team  also  found  statistically  significant  and  substantively  strong  nega¬ 
tive  correlations  between  OTS  recruiting  in  the  cyber-relevant  degree 
fields  and  economic  growth.  Due  to  the  need  for  stable  accessions  of 
technically  savvy  officers  in  the  cyber  domain  and  the  stability  that 
ROTC  and  the  USAFA  confer  in  officer  accessions,  we  further  recom¬ 
mend  that  the  Air  Force  plan  to  access  its  cyberspace  officers  entirely 
through  the  USAFA  and  ROTC  (OPR:  HAF/A1D,  AU,  USAFA,  SAF/ 
FM,  AETC). 

Cyberspace  operations  officers  cannot  be  created  overnight.  Newly 
accessed  second  lieutenants  begin  with  UCT,  a  six-month  course  in 
basic  cyberspace  skills.  These  officers  then  proceed  to  the  39  IOS, 
where  they  top  off  their  skills  in  the  INWT  course.  From  there,  they 
enter  mission  qualification  training  at  their  final  gaining  unit.  The 
17Ds  don’t  achieve  full  mission  qualification  in  fewer  than  66  weeks 
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from  the  day  they  entered  the  service,  and  most  of  them  will  take 
longer.56  Clearly,  the  lag  time  is  considerable  from  the  moment  of 
recruitment  or  accessions  to  full  development  of  a  mission-ready 
cyberspace  operator. 

For  those  officers  assigned  to  national  cyber  mission  teams  (CMT) 
(17S),  this  path  is  longer  still.  Added  to  all  the  courses  above  is  an 
extensive  in-house  training  course  administered  by  USCYBERCOM. 
This  course,  which  has  an  OJT  component,  lasts  a  minimum  of  44  weeks 
and  can  involve  as  much  as  6  months  of  additional  OJT  for  operators 
who  are  slower  to  achieve  the  needed  level  of  proficiency.57  For  these 
operators,  this  timeline  can  stretch  to  well  over  two  years  (fig.  13).58 


Months 

■  Basic  Training  ■  Clearance  ■  JointTraining 

■  IQT/Tech  Training  ■  Assignment  ■  OJT/job  qualification  requirement 

■  INWT  ■  Joint  Cyber  MQT 

Analysis  Center 

Figure  13.  Developmental  timeline  for  some  cyberspace  specialties. 

(Provided  by  Maj  Rosaiah  D.  Manigault,  chief  of  cyberspace  ISR  opera¬ 
tions,  AFISRA/A3C,  to  Dr.  John  P.  Geis  II,  AFRI,  e-mail,  7  March  2014.) 

Like  their  rated  flying  counterparts,  cyberspace  operators  face  se¬ 
rious  challenges  in  remaining  operationally  current.  Cyberspace 
tools,  vulnerabilities,  and  some  of  the  underlying  technologies 
change  rapidly — sometimes  at  an  exponential  rate.  Cyber  operators 
in  the  field  are  then  forced  to  be  in  training  on  a  recurring  basis, 
sometimes  as  often  as  every  90  days.59  These  field  units,  however, 
have  no  manning  or  budget  to  conduct  this  in-house  training  activity. 


FORCE  DEVELOPMENT  105 


Although  training  frequency  varies  by  unit  and  mission,  the  essential 
point  is  that — much  like  flying — cyberspace  operations  is  a  field  that 
someone  can  step  away  from  for  only  a  short  period.  An  operator 
must  continually  undergo  some  level  of  requalification  training  to  be 
at  the  proficiency  level  needed  to  work  in  or  supervise  a  cyberspace 
operations  center. 

In  terms  of  force  management,  this  precept  is  highly  analogous  to 
the  way  pilots,  computer  systems  officers,  and  other  rated  operations 
personnel  are  managed.  If  placed  in  a  staff  position  or  taken  out  of  a 
cockpit  for  more  than  about  a  year,  these  operators  must  reenter  their 
field  via  a  transition  course  that  updates  them  on  the  weapon  system 
and  enables  them  to  regain  proficiency  in  a  safe  environment  where 
operational  missions  are  not  at  risk.  In  essence,  it  retrains  them  to  the 
point  where  they  are  current  and  proficient  in  the  weapon  system. 
This  study  finds  that  for  cyberspace  operators  who  have  been  away 
from  the  mission  for  staff  tours  or  other  duties,  a  similar  retraining 
concept  is  required.  The  team  recommends  that  a  formal  transition 
course  be  established  for  operators  on  the  national  mission  or  sup¬ 
port  teams  and  on  the  cyber  mission,  support,  or  protection  teams. 
This  course  should  be  required — similar  to  the  rated  force — for  those 
who  spend  more  than  12  but  fewer  than  48  months  away  from  the 
operations  floor.  Beyond  a  48-month  absence,  this  study  recom¬ 
mends  full  mission  requalification. 

From  a  force  development  standpoint,  a  career  pyramid  highly 
analogous  to  the  rated  career  field  appears  appropriate  for  the  cyber¬ 
space  operations  career  field  (fig.  14).  Eleven  percent  of  this  field  is 
currently  designated  as  17S  AFSC  positions.60  These  personnel  are 
involved  in  the  NMTs,  national  support  teams,  CMTs,  cyber  support 
teams,  and  CPTs.  The  remaining  89  percent  of  the  officers  in  the  cy¬ 
berspace  operations  career  field  are  designated  as  17Ds.  They  main¬ 
tain  day-to-day  operations  for  the  squadrons,  groups,  wings,  and 
higher-level  organizations  in  the  Air  Force. 
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Figure  14.  17D  career  pyramid 


1B4  Enlisted  Cyberspace  Defensive  Operations 

The  enlisted  1B4X1  career  field  is  the  enlisted  counterpart  to  the 
17S  officer  career  field.  Enlisted  cyberspace  defensive  operators  are 
major  components  of  our  cyberspace  mission  forces,  national  mission 
forces,  and  cyberspace  protection  teams  being  built  by  USCYBERCOM. 
As  such,  this  career  field  is  critical  to  the  success  of  USAF  cyberspace 
operations.  It  is  also  one  in  which  manning  is  currently  very  tight. 

At  present,  the  career  field  is  poorly  manned.  Of  the  483  authori¬ 
zations,  only  298  are  filled — a  rate  of  61.7  percent.61  For  this  reason, 
the  1B4  career  field  is  among  a  small  number  of  enlisted  AFSCs  that 
currently  receive  selective  reenlistment  bonuses.  As  of  1  January 
2015,  the  bonus  multiplier  was  2.0  for  zone  A,  4.0  for  zone  B,  and  3.0 
for  zone  C,  making  these  bonuses  among  the  most  generous  in  the 
Air  Force.62 

Retention  in  the  career  field  is  satisfactory.  Interviews  with  com¬ 
manders  suggest  a  mean  retention  rate  of  around  97  percent  for  en¬ 
listed  personnel  working  in  the  NMTs  or  at  USCYBERCOM.  Airmen 
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at  these  locations  and  in  these  missions  have  a  high  level  of  job  satis¬ 
faction,  believe  their  day-to-day  duties  are  crucial  to  national  secu¬ 
rity,  and  appear  to  have  good  morale.63  Headquarters  Air  Force  track¬ 
ing  indicates  that  overall  retention  rates  for  the  field  range  from  a 
high  of  93  percent  for  those  in  zone  E  (more  than  18  years  of  service) 
to  a  low  of  71  percent  for  those  in  zone  B  (6-10  years  of  service).64 
Retention  issues  appear  to  arise  at  the  point  where  an  individual  as¬ 
signed  to  the  national  mission  receives  an  assignment  either  to  a  sup¬ 
port  or  to  an  educational  institution.  At  this  juncture,  anecdotal  in¬ 
formation  suggests  that  a  retention  problem  may  exist.  For  example, 
three  senior  enlisted  NCOs  with  over  18  years  of  service — less  than 
two  years  from  retirement — gave  up  their  prospective  retirement 
benefits  and  separated  in  the  past  year  rather  than  accept  assignment 
away  from  the  national  mission  to  become  instructors  at  Keesler’s 
cyberspace  training  unit.  A  contract  firm  hired  these  cyber  operators, 
allowing  them  to  remain  in  the  national  capital  region.65 

The  career  field  is  undermanned  largely  due  to  the  rapid  growth  of 
its  manpower  requirements.  Significant  investment  is  under  way  to 
improve  the  capacity  of  the  81  TW  to  handle  additional  student 
throughput.66  AFSPC  committed  $800,000  in  the  FY  2014  budget  to 
build  four  new  facilities  for  student  instruction  at  the  classified  level. 
It  allocated  an  additional  $1.5  million  for  cyberspace  range  facilities 
to  expand  the  wing’s  ability  to  graduate  new  cyberspace  students, 
both  officer  and  enlisted,  at  an  accelerated  rate. 

While  these  investments  will  help  increase  throughput  and  quality 
of  training,  this  study  revealed  that  the  cyber-range  facilities  at  Keesler 
and  elsewhere  in  our  Air  Force  are  operated  and  funded  on  an  ad 
hoc  basis,  unlike  range  facilities  in  the  other  operational  domains. 
This  study  recommends  that  all  cyberspace  training  ranges — including 
those  at  Keesler  AFB  and  Hurlburt  Field,  Florida — be  made  formal 
programs  embedded  within  the  POM  process  in  the  same  manner  as 
the  training  ranges  in  the  air  domain.  The  POM  process  should  be 
used  for  maintenance,  operations,  and  upgrade  of  facilities  on  a 
planned  rather  than  an  ad  hoc  basis  (OPR:  AETC,  AFSPC,  SAF/Fi- 
nancial  Management  [FM] ). 

The  development  of  enlisted  cyberspace  operators  begins  after 
their  first  assignment.  Designation  of  this  field  as  “retrain  only” 
means  that  prospective  cyberspace  defense  operators  must  complete 
an  introductory  assignment  and  then  apply  for  the  necessary  retraining 
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into  the  1B4  career  field.  Those  being  retrained  often  come  from  one 
of  the  3D  (cyberspace  systems)  career  fields,  discussed  later.67 

The  1B4X1  students  are  all  retraining  NCOs,  many  of  whom  come 
from  the  3D  cyberspace  career  fields.  As  shown  in  table  5,  these  1 1 
diverse  cyber  support  specialties  form  the  core  for  enlisted  cyber  sup¬ 
port.  However,  they  are  in  a  state  of  transition. 

Table  5.  Enlisted  cyber  support  AFSCs 


AFSC 

Career  field  description 

3D0X1 

Knowledge  operations* 

3D0X2 

Cyber  systems  operations 

3D0X3 

Cyber  surety 

3D0X4 

Computer  systems  programs 

3D1X1 

Client  systems 

3D1X2 

Cyber  transport 

3D1X3 

Radio  frequency  transport 

3D1X4 

Spectrum  operations 

3D1X5 

Radar* 

3D1X6 

Airfield  operations* 

3D1X7 

Cable  and  antenna  systems 

Adapted  from  81st  TW  POI,  Undergraduate  Cyber  Training 
(Phase  2),  E30BR17D1  0A1A,  2  October  2012. 

‘Source  material  is  in  a  state  of  transition  at  the  time  of  this  writing. 

As  stated,  many  3DX  Airmen  are  retraining  to  fill  the  1B4X1  void 
created  by  increased  emphasis  on  cyber  defense.  Currently,  the 
1B4X1  career  field  does  not  admit  new  recruits — only  Airmen  transi¬ 
tioning  to  their  second  assignment.  This  practice  presents  certain  ad¬ 
vantages,  especially  considering  the  duration  of  the  training.  These 
(re)trainees  have  completed  at  least  one  assignment,  are  familiar  with 
the  normal  Air  Force  /  military  lifestyle,  have  a  basic  knowledge 
gained  in  BMT,  and  already  understand  the  basic  customs  and  cour¬ 
tesies.  In  other  words,  they  have  a  level  of  military  experience  and 
maturity  desired  in  this  career  field. 

At  the  time  of  this  writing,  the  1B4  course  throughput  is  problematic. 
The  current  schedule  of  four  classes  yearly  with  12  students  each  is 
insufficient  to  meet  the  Air  Forces  cyber  force  requirements,  espe- 
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dally  as  the  demand  for  lB4s  increases  for  the  national  mission  at 
USCYBERCOM.  Students  enter  their  initial  phase  of  training  to  be¬ 
come  cyber  defense  operators  at  Keesler,  where  they  learn  the  funda¬ 
mentals  and  foundations  for  their  cyber  mission.  This  course  pro¬ 
vides  1B4X1  training  for  performing  their  duties  to  develop,  sustain, 
and  enhance  network  capabilities  to  defend  national  interests  from 
attack  and  to  create  effects  in  cyberspace  to  achieve  national  objec¬ 
tives.68  The  12-unit  program  covers  679  academic  hours  of  instruc¬ 
tion  over  85  training  days  (approximately  16  weeks)  and  is  skewed 
more  toward  theory  and  less  toward  practicum. 

Table  6  shows  the  syllabus  for  the  12  units  of  initial  cyberspace 
defense  operations  training,  which  begins  with  an  overview  of  skills 
needed  for  cyberspace  defense,  such  as  network  warfare  principles 
and  information  assurance.  The  course  progresses  through  other  key 
elements — including  various  operating  systems,  network  exploita¬ 
tion,  industrial  control  systems,  and  cyber  threats  and  defense — 
culminating  with  its  capstone  event  of  fighting  through  a  cyber  at¬ 
tack.  At  the  end  of  each  block,  except  the  capstone  block,  students 
are  challenged  with  a  written  test.  In  capstone  block  12,  the  cyber 
attack  is  their  test. 


Table  6. 1 B4X1  course  of  instruction  for  cyberspace  defense  operations 


Block  1 :  Cyberspace  defense 
overview 

Block  2:  Laws  and  ethics 

Orientation 

Cyberspace  defense  operations 
career  field 

Cyber  1 01 

Network  warfare  principles 
Information  assurance 

Standardization  and  evalua¬ 
tion  program 

Federal  laws  governing  network 
monitoring 

International  and  operations  law 
Ethics  regulations  and  obligations 

Block  3:  Operating  systems 
(OS)  and  architecture 

Block  4:  Advanced  information 
technology 

Microsoft  Windows  OS 
UNIX/LINUX  (*NIX)  OS 

Mobile  OS  and  architecture 

Networking  principles 

System  configurations 

Traffic  analysis 
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Table  6  ( continued ) 


Block  5:  AF  enterprise 
structure  and  defense 

Block  6:  Attacking  and  exploiting 
cyber  networks 

Air  Force  enterprise 

Tools  and  applications 

Cyber  operations 

Network  warfare  operations 
Attacking  and  exploiting  cyber 
networks 

Wireless  communication  attack/ 
defense 

Block  7:  Telephony  networking 

Block  8:  Mobile,  space,  and 
satellite  networks 

Telephony  networks 

Mobile  networks 

Satellite  and  space  communications 

Block  9:  Battlefield  networks 

Block  10:  Industrial  control 
systems 

Integrated  air  defense  networks 
Combat  support  (command 
and  control)  /  tactical  data  link 
(TDL)  networks 

Industrial  control  networks 

Block  1 1 :  Cyber  network 
threats  and  defense 

Block  12:  Fighting  through  a  cyber 
attack  (capstone) 

Cyber  network  threats  and 
defense 

Fighting  through  a  cyber  attack 
Course  feedback  and  graduation 

Reproduced  from  81st  TW,  Tentative  POI,  Cyber  Defense  Operations,  E3ALR1B431 
0A1A,  7  November  2013. 


Once  students  graduate  from  the  Keesler  course,  they  move  on  to 
AFSPC’s  39 IOS  eight-week  INWT  at  Hurlburt.  INWT  is  an  advanced 
course  providing  IQT  to  cyber  operators.  Students  at  INWT  take  the 
basic  skills  learned  in  initial  cyberspace  defense  operations  training 
and  dive  deeper  with  more  hands-on  activities — comprising  about  40 
percent  of  the  course. 

Students  are  taught  a  variety  of  skills  to  build  their  foundation  for  net¬ 
work  programming  and  operations.  These  skills  include  the  following: 

•  Building  a  virtual  network  interacting  with  firewalls,  servers, 
and  routers  as  well  as  other  networks. 

•  Handling  incidents  and  conducting  forensic  analysis. 

•  Mastering  hacking  and  attacking  techniques. 

•  Working  with  the  various  intelligence  disciplines  that  cyber  op¬ 
erators  are  likely  to  encounter  during  operations. 
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•  Developing  a  cyber-operations  strategy  and  mission  planning. 

•  Understanding  the  responsibilities  of  the  network  warfare  op¬ 
erations  cell. 

•  Employing  offensive  cyber  operations  capabilities  against  IP  and 
functional  networks  such  as  IADS. 

•  Understanding  the  chain  of  command  for  network  defense  and 
the  devices  used  to  protect,  detect,  and  defend  the  network. 

The  course  concludes  with  a  capstone  mission  evaluation.  Students 
divide  into  offensive  and  defensive  roles,  depending  on  the  mission  of 
their  follow-on  assignment,  and  respond  to  a  series  of  injections  to 
demonstrate  their  grasp  of  course  objectives  (table  7). 

Table  7.  Intermediate  Network  Warfare  Training 


Module  0 

Module  1 

Core  concepts 

Hacker  techniques,  exploits, 
and  incident  handling — SANS 
504.MIL 

Module  2 

Module  3 

Intel 

Planning 

Module  4 

Module  5 

Offensive  cyber  operations  and 
methodologies 

SANS  NETWARS 

Module  6 

Capstone 

Defensive  cyber  operations  and 
methodologies 

Exercise 

Developed  from  39  IOS,  Intermediate  Network  Warfare  Training,  IOS-INWT  001,  PDS  CODE 
06S,  Initial  Qualification  Training  Version  1.2,  February  2014. 


Upon  completion  of  INWT,  lB4s  report  to  their  gaining  unit  for 
OJT.  For  the  few  students  selected  for  national- level  positions  on  one 
of  the  NMTs,  the  NSA  and  USCYBERCOM  provide  about  two  years 
of  OJT  and  mission  qualification  training.  lB4s  receive  OJT  at  their 
gaining  unit.  If  that  unit  is  USCYBERCOM,  the  training  is  extensive 
and  can  last  more  than  an  additional  18  months.  Those  assigned  to 
other  systems  can  become  mission  ready  in  as  little  as  one  year  from 
the  date  they  entered  training  at  Keesler  (fig.  15).  The  1B4  Airmen  are 
certified  as  5-level  cyberspace  defense  operations  journeymen  once 
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they  have  completed  their  career  development  courses  (CDC)  and 
OJT  training,  passed  a  single  scope  background  investigation  (SSBI), 
and  received  a  Top  Secret  clearance. 


Summit  DE 

Chief's  Leadership  Course 

Professional  Education 

CCM  Orientation 
CMSgt  Orientation 


Professional  Education 

Cyberspace  Superintendent  Course 
Professional  Management  Certification 
AFIT,  AAD 


PDE 

Senior  NCO  Academy 

>  Professional  Education 

L  Cyber  300,  AAD 


Team  CC/Team  DO  COCOM  Staff 
MAJCOM  AO  Instructor/Stan  Eval 

Career  Broadening/Special  Duty 


NMT  USCYBERCOM 
CMFTeam 


NST  USCYBERCOM 
CPTTeam 


CNODP  or  Entry-Level  Assignment 
Intelligence  Officer  School 


PDE 

NCO  Academy 
Professional  Education 

Associate's  Degree/CCAF 
Cyber  200,  NCO  Academy, 
k  Cyberspace  Career 
Advancement  Course 
CNODP 

Professional  Education 

Airman  Leadership 
School 

A  First-Term 
Airman's  Course 


Figure  15. 1B4  enlisted  cyberspace  defense  operations  career  development 

After  promotion  to  staff  sergeant,  the  next  step  in  upgrading  one’s 
qualifications  begins.  Staff  sergeants  are  eligible  for  the  Cyberspace 
Career  Advancement  and  Cyberspace  200  courses,  which  educate 
new  staff  sergeants  so  that  they  may  successfully  demonstrate  mas¬ 
tery  of  the  equipment  at  their  location  and  lead  to  a  “craftsman”  or 
7-level  certification.69 

Staff  sergeants,  as  NCOs,  develop  leadership  skills  through  their 
positions  and  assignments.  Special  duty  assignments  as  an  instructor 
and  supervision  of  more  junior  Airmen  and  journeymen  in  the  field 
are  all  part  of  developing  the  leadership  skills  necessary  to  serve  at  a 
higher  level.  Further,  at  this  point,  those  staff  sergeants  serving  in  the 
field  supporting  Air  Force  units  will  have  their  final  chance  to  attend 
the  CNODP  and  gain  specific  expertise  in  cyber  issues  relevant  to  the 
NMTs.  This  training  lasts  approximately  two  years  and  generates  less 
payback  at  the  more  senior  grades.  Personnel  interested  in  pursuing 
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this  aspect  of  cyberspace  defense  should  do  so  by  their  10th  year  in 
service  or  before  sewing  on  technical  sergeant.70 

NCOs  should  consider  which  degree  to  pursue  as  they  continue 
their  education.  The  Community  College  of  the  Air  Force  (CCAF) 
offers  associates  degrees,  and  most  bases  with  cyberspace  missions 
have  nearby  universities  that  offer  bachelor’s  or  higher  degrees  in  the 
computing  sciences.  Because  these  courses  of  instruction  are  multi¬ 
year  and  such  degrees  are  not  required  for  leaders  at  more  junior  lev¬ 
els,  the  promotion  system  for  enlisted  cyberspace  leaders  does  not 
consider  these  education  accomplishments  until  the  senior  grades. 

Technical  sergeants  have  the  opportunity  to  attend  the  NCO  Academy 
in  preparation  to  lead  at  higher  levels.  As  enlisted  members  in  this 
career  progress  further,  leadership  opportunities  will  abound  as 
NMT  noncommissioned  officer  in  charge  (NCOIC),  squadron  first 
sergeant,  group  first  sergeant,  and  staff  positions  at  the  wing,  NAF, 
MAJCOM,  and  joint  command  headquarters. 

Prior  to  becoming  a  senior  master  sergeant,  members  of  this  ca¬ 
reer  field  must  attend  the  Cyberspace  Superintendent’s  Course.  At 
this  point,  enlisted  leaders  are  ready  for  senior  supervisory  duties 
that  will  enable  them  to  supervise  larger-scale  cyber  operations.  Be¬ 
yond  this  point,  capstone  professional  development  education  and 
selection  to  chief  master  sergeant  open  doors  to  become  wing,  NAF, 
and/or  MAJCOM  command  chief  master  sergeant.  Other  senior 
positions  of  great  importance  include  functional  managers  for  the 
career  field  at  the  MAJCOM  and  HAF  levels,  commandant  of  the 
NCO  and  Senior  NCO  Academies,  and  potentially  serving  as  the 
chief  master  sergeant  of  the  Air  Force. 

The  research  team  makes  the  following  observations  and  recom¬ 
mendations  for  the  1B4  career  field.  The  team  found  that  the  training 
to  be  a  fully  capable  cyberspace  defense  operator  at  the  national  level 
is  as  long  as  or  longer  than  that  for  most  aircrew  members.  Recent 
implementation  of  a  six-year  ADSC  for  operators  who  are  trained  for 
the  national  mission  is  appropriate  because  it  guarantees  at  least  a 
reasonable  payback  to  the  Air  Force  for  time  spent  in  training.  The 
study  also  found  widespread  agreement  among  the  operating  agen¬ 
cies  that  advanced  degrees  in  the  computer  sciences  are  helpful  to 
achieving  success  in  this  field.  This  study  thus  recommends  that  the 
1B4  career  field  be  given  priority  in  allocation  of  tuition  assistance 
and  other  academic  programs  in  those  fiscal  years  where  resources 
are  tight  (OPR:  Al). 
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We  have  also  found  evidence  that  retention  is  correlated  with  IT 
business  expansion,  which  in  turn  is  correlated  with  growth  in  the  US 
economy.  Given  that  it  takes  up  to  three  years  to  create  a  fully  trained 
cyber  defense  operator,  a  system  that  is  reactive  to  retention  trends 
could  result  in  the  creation  of  “manpower  bathtubs”  as  a  result  of 
delayed  reactions  to  attrition  that  takes  years  to  fill.  Therefore,  this 
study  recommends  that  the  A1  make  deliberate  use  of  the  Confer¬ 
ence  Board  Leading  Economic  Index  (often  called  the  index  of  lead¬ 
ing  economic  indicators)  in  combination  with  existing  manning  and 
retention  statistics  to  adjust  selective  reenlistment  bonuses  and  other 
retention  incentives  to  curb  adverse  manpower  trends  before  man¬ 
ning  reaches  crisis  levels  (OPR:  Al).71 

Enlisted  Cyberspace  Intelligence  Analyst 

1NXXX — Highly  Specialized  Cyberspace  Intelligence  Analyst 

The  enlisted  intelligence  career  field  1NXXX  is  the  baseline  for  all 
cyber  ISR  positions  within  both  the  national  and  USCYBERCOM 
infrastructure.  As  new  cyberspace  ISR  mission  forces  were  created 
and  the  demand  for  cyberspace  ISR  analysts  increased  in  the  early 
2010s,  the  intelligence  field  drew  upon  several  AFSCs  to  fill  cyber¬ 
space  positions.  These  included  the  1N0XX  operations  intelligence 
field  to  fill  all-source  intelligence  analyst  positions  across  the  cyber 
force,  the  1N2X1C  signals  intelligence  analysts  to  bolster  cyberspace 
manpower  in  the  national  mission  community,  and  the  1N3XXX 
cryptologic  language  analysts  who  were  also  used  in  the  national  and 
cyber  mission  force  structures.72 

With  the  exception  of  the  lN3XXXs,  the  intelligence  career  field  is 
moving  those  Airmen  trained  as  highly  specialized  cyberspace  ISR 
personnel  into  the  newly  designated  1N4X1A  (fusion  analyst  /  digital 
network  analyst)  AFSC.  Traditional  1N4X1B  fusion  analysts  (analy¬ 
sis  and  production)  who  can  move  between  missions  will  be  desig¬ 
nated  with  the  1N4X1B  AFSC.  It  is  the  “A”  shred,  the  1N4X1As,  that 
is  of  greatest  interest  to  the  cyberspace  community,  and  that  is  the 
specific  career  field  examined  here.73 

1N4X1A — Highly  Specialized  Cyberspace  Intelligence  Analyst 

New  recruits  into  the  intelligence  career  field  begin  their  careers  at 
the  3-skill-level  in-residence  course  at  Goodfellow  AFB.74  Unlike  the 
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1B4  career  field,  1N4X1 A  is  open  to  direct  accessions  coming  straight 
from  basic  training.  Combined,  the  general  intelligence  (1NX)  and 
1N431A/B  courses  total  106  contact  days.  Completion  of  these  aca¬ 
demics  results  in  the  award  of  an  apprentice  AFSC  1N431A/B.  Those 
who  continue  along  the  cyberspace  ISR  1N4X1A  path  attend  the 
Joint  Cyber  Analysis  Course  (JCAC)  at  Corry  Station,  Florida.75  The 
JCAC — 120  contact  days,  or  approximately  24  weeks — exposes  stu¬ 
dents  to  a  broader  range  of  experiences  and  teaches  them  tools  and 
techniques  to  overcome  adversaries.76  When  all  the  training  time  for 
a  new  cyberspace  ISR  recruit  is  added  together — including  the  eight  - 
and-a-half-week  BMT  course,  the  courses  at  Goodfellow,  and 
JCAC — it  is  about  one  year  before  a  new  recruit  arrives  at  his/her 
duty  location,  where  OJT  will  also  be  provided  (see  fig.  16  for  the 
proposed  1N4X1A  career  pyramid). 
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Figure  16.  Proposed  1N4X1A  fusion  analyst  /  digital  network  analyst 
career  pyramid. 

If  the  1N4X1  As  initial  assignment  calls  for  working  on  national  or 
cyber  mission  systems  with  the  NSA  or  USCYBERCOM,  then  more 


116  FORCE  DEVELOPMENT 


robust  training  is  necessary.  For  individuals  in  this  field  whose  first 
assignment  is  outside  the  NMTs,  this  training  becomes  required 
upon  first  assignment  to  the  team.  Since  this  training  is  tailored  to  the 
individual,  especially  in  later  phases,  it  can  last  up  to  18  months. 

For  promotion  to  staff  sergeant,  Airmen  must  complete  the  Air¬ 
man  Leadership  School.  Once  promoted,  they  pursue  upgrade  to 
7-level  (craftsman).  At  this  level,  assignments  generally  remain  opera¬ 
tional  as  new  NCOs  increase  career  proficiency.  To  this  end,  the  Center 
for  Cyberspace  Research  offers  the  Cyberspace  200  course.77  In  addition 
to  Cyberspace  200,  staff  sergeants  should  consider  additional  educa¬ 
tion  via  the  CCAF  (required  for  senior  rater  endorsement)  or  through 
a  separate,  accredited  academic  degree  program. 

Upon  promotion  to  technical  sergeant,  craftsman  1N4X1As  may 
broaden  their  careers  into  a  variety  of  PME  and  technical  training 
instructor  positions.78  At  this  point,  attendance  at  the  NCO  Academy 
is  mandatory  for  senior-rater  endorsement  to  be  considered  for  pro¬ 
motion  to  senior  master  sergeant. 

As  the  cyberspace  intelligence  analyst  reaches  the  senior  enlisted 
ranks,  additional  education  and  leadership  opportunities  are  avail¬ 
able.  Educational  opportunities  include  the  Cyberspace  300  course 
and  continued  work  on  academic  degrees  and  certifications.  Leadership 
opportunities  for  master  sergeants  include  NCOIC  positions  at  the 
squadron  level  and  cyber  and  national  mission  force  teams.  Senior 
master  sergeants  may  compete  for  squadron  and  group  NCOIC  posi¬ 
tions,  and  the  chief  master  sergeants  have  wing-  and  command-level 
chief  positions  available.  The  9-level  (superintendent)  development 
in  the  career  field  should  be  completed  at  the  rank  of  senior  master 
sergeant.  In  addition  to  the  operational  unit  NCOIC  positions,  senior 
staff  positions  at  the  NAF,  MAJCOM,  combatant  command,  and  Air 
Staff  are  also  positions  for  which  senior  NCOs  may  compete. 

Enlisted  Intelligence  Career  Field  Observations  and  Findings 

This  study  finds  that  the  intelligence  career  fields  related  to  the 
national  and  cyber  mission  forces  are  developing  quickly.  HAF/A2 
has  consistently  been  proactively  working  issues  uncovered  by  the 
research  team,  whether  as  a  result  of  our  discussions  or  simultaneous 
discovery  of  issues  by  their  staff.79  Over  the  course  of  this  study,  re¬ 
tention  bonuses  were  instituted  in  fields  where  cracks  in  retention 
appeared,  and  six-year  enlistments  were  implemented  for  positions 
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requiring  extensive  training.  In  response  to  discussions  on  the  enor¬ 
mous  cost  of  training  an  intelligence  analyst  for  cyberspace,  career 
field  managers  have  aligned  the  1N4X1A  specialty  in  such  a  manner 
that  they  routinely  move  from  one  cyberspace  ISR  assignment  to  an¬ 
other,  thus  minimizing  the  training  bill  the  Air  Force  will  have  to  pay 
to  keep  these  analysts  current  in  their  operational  field.  The  only  ex¬ 
ception  to  the  “cyberspace  ISR  to  cyberspace  ISR”  assignment  rule 
will  be  for  selected  career  broadening  and  instructor  opportunities.80 

13NXXX  Cryptologic  Language  Analysts  and  Foreign 
Language  Requirements  for  the  Cyber  Mission  Force 

An  unanticipated  finding  during  this  research  project  concerned 
the  nature  of  formal  requirements  for  cyber  linguists.  The  Joint  Staff’s 
Human  Capital  Division  (JCS-J1)  approved  over  300  new  DOD  lin¬ 
guist  billets  in  support  of  the  cyber  mission  following  workshops 
with  USCYBERCOM  in  late  2012.  Of  these  billets,  105  were  ear¬ 
marked  for  the  Air  Force  to  support  the  buildup  of  its  Cyber  Mission 
Force  through  20 16.81  The  geographic  locations  mirror  those  for  the 
SIGINT  mission,  but  the  cyber  language  requirements  are  separate 
and  distinct  from  those  for  SIGINT. 

Language  Needs  for  Cyber  Operations 

Interviews  with  lN3XXXs  supporting  USCYBERCOM  on  cyber¬ 
space  ISR  teams  and  their  supervisors  reveal  that  language  skills  are 
only  part  of  the  cryptologic  language  analyst  puzzle.82  Just  as  in  English, 
computer  coding  is  not  intuitive  even  if  one  is  fluent  in  a  particular 
language.83  Although  the  Air  Force  tests  cryptologic  language  analysts 
to  codify  listening,  reading,  and  speaking  skills,  writing  skills  are  less 
well  evaluated.  Writing  skills  in  computer  code  are  not  tested  at  all. 

Linguists  embedded  within  teams  supporting  cyberspace  ISR  mis¬ 
sions  must  not  only  be  fluent  in  their  respective  languages  but  also  be 
able  to  occasionally  draw  upon  the  skills  of  reading  computer  code  in 
those  languages.  Most  computer  code,  even  that  in  a  foreign  lan¬ 
guage,  will  decompile  into  a  machine  language  that  most  cyber  ex¬ 
perts  can  readily  understand.  In  most  cases,  the  comprehension  of 
machine  language  instructions  is  sufficient  for  the  Air  Force’s  cyber 
defense  needs.  However,  the  research  team  learned  of  operational  in¬ 
stances  in  which  cyber  operators  encountered  computer  instructions 
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not  in  English  that  required  interpretation.  Though  uncommon,  such 
events  suggest  that  more  needs  to  be  done  to  ensure  that  our  cyber 
ISR  operations  locations  maintain  a  readily  available  cadre  of  people 
who  not  only  speak  foreign  languages  but  also  can  program  or  under¬ 
stand  programming  that  uses  these  languages.  Further,  even  when 
the  programming  itself  may  decompile  into  binary  or  computer  code, 
the  documentation  and  notes  in  the  programming  code  are  usually  in 
the  programmer’s  native  tongue. 

Based  on  initial  estimates  of  language  needs,  the  Air  Force  A2  staff 
(HAF/A2D)  has  filled  the  training  pipeline  with  the  needed  Airmen.84 
Training  of  this  cohort,  however,  will  take  up  to  two  years  from  acces¬ 
sion  to  first  assignment.  In  the  interim,  the  Air  Force’s  1N3X0  commu¬ 
nity  must  perform  both  the  SIGINT  and  cyber  linguist  missions  with 
its  available  resources.  Figure  17  depicts  this  initial  language  laydown. 
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Figure  17.  Air  Force  NMT/combat  mission  direct  support  team  (CST) 
language  requirements.  (Developed  from  data  provided  by  JCS/J1 
[Manpower  and  Personnel],  Pentagon,  Washington,  DC.) 

Cyber  events  occur  everywhere  in  the  world,  and  the  use  of  local 
languages  and  street  slang  in  native  dialects  in  chat  rooms  and  on 
social  media  continues  to  rise.85  Focal  patois  will  be  an  impediment 
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to  quick  US  analysis  and  understanding,  requiring  more  language  ex¬ 
pertise  in  the  future  rather  than  less.  Because  language  is  developing 
into  a  greater  cyber  enabler,  this  study  recommends  that  Air  Forces 
Cyber  (AFCYBER)  evaluate  the  various  languages  in  which  program¬ 
ming  is  currently  found  and  establish  requirements  for  programming- 
proficient  linguists.  Once  these  standards  are  established,  this  study 
further  recommends  conducting  an  analysis  of  alternatives  to  deter¬ 
mine  whether  this  need — often  episodic — is  best  met  by  military, 
civilian,  or  contract  personnel  and  whether  physical  or  virtual  availability 
is  sufficient. 

As  AFCYBER  conducts  this  review,  the  research  team  noticed  that 
of  the  existing  language  requirements,  none  apply  to  most  of  Africa.86 
In  fact,  the  current  language  plan  focuses  on  just  a  few  languages  for 
the  force,  to  the  exclusion  of  many  others.  The  Air  Force  plans  for 
nine  language  shreds  as  categories  for  managing  its  linguists,  using  a 
10th  shred  for  all  others,  characterized  as  “low  flow”  languages.  Al¬ 
though  French  is  the  principal  language  used  throughout  almost  all 
of  Africa,  it  is  among  the  low-flow  languages.  Such  is  the  case  despite 
the  fact  that  French  is  an  official  language  in  33  foreign  countries — 
more  than  any  other  language  except  English.  It  is  the  sixth  most  com¬ 
monly  spoken  language  on  the  planet — with  292  million  speakers — 
and  the  third  most  used  language  on  the  Internet.87  When  the  research 
team  asked  why  the  Air  Force  has  this  management  focus,  respon¬ 
dents  replied  that  it  was  because  many  francophone  countries  don’t 
have  air  forces.  From  this  discussion  and  others,  this  study  finds  that 
although  the  Air  Force  has  committed  to  supporting  language  re¬ 
quirements  for  the  air  domain,  it  has  not  done  so  for  the  cyber  do¬ 
main,  which  is  less  defined  by  nation-states,  boundaries,  or  even  the 
presence  or  absence  of  an  air  force. 

Lastly,  a  consideration  for  cyber  operations  entails  developing  a 
database  of  individuals  proficient  in  required  languages.  Our  most 
recent  conflicts  have  not  given  the  United  States  the  years  of  warning 
necessary  to  fully  train  cyber  linguists.  Therefore,  AFCYBER  should 
evaluate  the  utility  of  establishing  an  on-call  language  assistance  ca¬ 
pability.  The  Military  Personnel  Data  System  (MilPDS)  is  an  often- 
used  resource  to  locate  people  with  hard-to-find  language  skills  for  a 
variety  of  customers,  but  this  database  is  populated  only  by  individuals 
receiving  Foreign  Language  Proficiency  Pay  (FLPP).  To  receive  FLPP, 
an  individual  first  must  take  the  Defense  Language  Proficiency  Test 
(DLPT),  which  offers  a  fairly  accurate  view  of  proficiency.  But  not 
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everyone  who  has  skill  in  another  language  chooses  to  take  the  test, 
creating  gaps  in  the  Air  Forces  total  language  proficiency  picture.88 

Even  for  those  who  do  take  the  tests,  this  study  found  deficiencies 
in  our  linguist  testing  modality  to  identify  prospective  cyberspace 
linguists.  Our  current  testing  for  language  skills  does  not  address  cy¬ 
ber  expertise  and  includes  only  simple  speaking,  listening,  and  read¬ 
ing.89  This  study  recommends  that  the  DOD  senior  language  authority 
initiate  planning  for  a  DLPT  Writing  Test  that  uses  the  existing 
American  Council  on  the  Teaching  of  Foreign  Languages  (ACTFL) 
2012  Writing  Proficiency  Test  as  a  guide.90  In  addition,  this  study  rec¬ 
ommends  that  a  computer  coding  component  be  added  to  this  lin¬ 
guistic  testing  to  identify  potential  cyberspace  linguistic  analysts. 

Upon  identification  of  individuals  with  these  skills,  this  study  rec¬ 
ommends  establishing  a  special  cyber  experience  identifier  for  cyber 
linguists  to  enable  tracking  them  in  the  various  personnel  databases. 
In  addition,  since  the  ability  to  read  programming  language  in  a  foreign 
tongue  is  not  a  skill  for  which  all  linguists  are  suited,  this  study  fur¬ 
ther  recommends  that  those  who  develop  this  skill  be  managed  simi¬ 
larly  to  their  1N4X1A  counterparts,  with  an  emphasis  on — but  not 
necessarily  exclusive  use  of— service  in  cyberspace  roles  and  missions.91 

The  ANG  and  AFR  have  a  resident  language  capability — a  natural 
fit  for  ad  hoc  and  surge  support.  This  study  recommends  that  until 
the  new  cyber  linguist  cohort  is  fully  established,  Guard  and  Reserve 
assets  should  be  used  to  address  any  short-term  manning  deficits.  As 
the  cyber  linguist  mission  matures,  Guard  and  Reserve  support  in 
this  area  may  also  grow.  To  fill  this  role,  these  components  will  need 
to  implement  tracking  procedures  for  foreign  language  expertise  as 
indicated  above. 

Whether  a  database  uses  SEIs  for  military  personnel  or  other  iden¬ 
tifiers  for  contract  help,  this  specialized  cadre  of  linguists  needs  to  be 
tracked  and  available  to  all  cyber  operations  everywhere.  Thus,  this 
study  recommends  that  a  tracking  system  of  this  expertise  be  main¬ 
tained  on  all  operational  cyberspace  floors  to  ensure  that,  when 
needed,  these  experts  can  be  called  upon  in  a  short  period  of  time — a 
condition  analogous  to  quick-reaction  alert  status.  Due  to  the  rapidly 
changing  nature  of  the  cyber  domain,  the  study  also  recommends 
that  AFCYBER  review  these  language  requirements  and  the  tracking 
mechanism  no  less  frequently  than  once  every  two  years  as  part  of 
the  formal  POM  cycle. 
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Regaining  Proficiency  through  a  Cyberspace  Transition  Course 

Cyberspace  ISR  currency  is  an  ongoing  concern  across  both  the 
1N4X1 A  and  1N3XXX  career  fields.  The  planned  back-to-back  cyber 
ISR  assignments  process  for  1N4X1A  Airmen  will  largely  alleviate 
these  concerns  but  not  completely.  As  with  their  cyber  counterparts, 
should  our  Airmen  in  the  cyberspace  intelligence  specialty  leave  for  a 
career  broadening  or  training  assignment,  the  Air  Force  will  need  a 
planned  approach  for  these  Airmen  to  regain  proficiency  in  the  rapidly 
moving  cyber  field  as  they  reenter  the  specialty.  This  study  recom¬ 
mends  establishing  a  formal  transition  course,  analogous  to  what  is 
done  in  the  flying  career  fields,  for  those  enlisted  and  officer  specialties 
requiring  high-end  cyber  operations.  Such  a  course  would  be  used  for 
those  who  have  left  cyberspace  operations  for  more  than  12  but  fewer 
than  48  months  to  reenter  the  field.  For  personnel  who  have  left  this 
field  for  more  than  four  years,  retraining  may  need  to  be  at  a  more 
basic  level,  analogous  to  the  “basic”  course  used  to  retrain  aviators 
who  have  left  the  cockpit  for  more  than  five  years.  Because  cyberspace- 
specific  skills  overlap  several  specialties,  this  study  recommends 
that  HAF/A2  and  HAF/A6S  examine  the  prospects  of  establishing  a 
single  cyberspace  transition  course  for  everyone  returning  to  the 
cyberspace  field  after  lengthy  periods  away  or  that  they  work  with 
USCYBERCOM  and  the  associated  joint  community  to  create  such 
a  course. 

Big-Data  Analysts 

As  its  capabilities  become  better  known,  “big  data”  will  increase  in 
importance  to  the  Air  Force  and  US  government  in  the  years  ahead. 
The  Blue  Horizons  III  study  concluded  that  perhaps  over  80  percent 
of  future  ISR  will  be  conducted  in  or  through  the  domain  of  cyberspace. 
With  over  75  million  photos  per  day  shared  on  Instagram  alone,  it  is 
now  possible  to  construct  near-real-time,  three-dimensional  walk¬ 
throughs  of  cities  and  major  buildings  of  interest  around  the  world.92  The 
key  to  making  ISR  work  in  and  through  cyberspace — both  to  deter  new 
weapons  of  mass  effect  and  to  target  adversaries — is  the  use  of  big  data.93 

Federal  spending  on  big- data- related  services  will  climb  45  percent 
in  the  next  three  years,  rising  from  $1.55  billion  in  2014  to  approxi¬ 
mately  $2.25  billion  by  2018.94  The  pattern  for  DOD  spending  is  likely 
to  be  similar.  Alex  Rossino,  an  analyst  at  Deltek,  states  that  “DOD 
spending  on  Big  Data-related  software  and  services  is  projected  to 
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jump  from  $670  million  in  2013  to  $880  million  in  20 18.”95  As  the 
DOD  moves  to  more  automated  systems  and  services,  these  numbers 
will  likely  increase  because  much  of  the  actual  future  investment  has 
yet  to  be  captured. 

In  examining  the  Air  Force  cyber  force  structure  and  personnel 
systems,  this  study  finds  that  despite  the  expanded  role  of  big  data  in 
the  Air  Force’s  future,  we  have  no  mechanism  to  identify  personnel 
who  have  the  skills  to  operate  these  types  of  data.96  The  research  team 
believes  that  this  emerging  field  will  require  greater  emphasis  in  the 
future  and  that  the  Air  Force  and  DOD  will  need  to  be  able  to  recruit, 
train,  and  track  analysts  capable  of  manipulating  big-data  sets  in  the 
near  term.  For  these  reasons,  the  study  recommends  that  AF CYBER 
and  Twenty-Fifth  Air  Force  collectively  and  comprehensively  exam¬ 
ine  the  needs  for  big-data  analysts,  establish  formal  requirements  to 
address  these  needs,  and  then  work  with  A1  to  establish  a  mechanism 
for  the  identification  and  tracking  of  this  specialized  expertise  within 
the  Air  Force  personnel  system. 

3DXXX  Career  Fields 

Several  career  fields  in  the  realm  of  what  is  often  called  cyberspace 
support  bear  mentioning  even  though  they  are  not  usually  associated 
with  the  national  or  cyber  mission  forces  that  are  this  study’s  princi¬ 
pal  concern.  The  career  progression  of  these  cyberspace  support 
fields  is  examined  next.  Some  career  fields  are  in  flux  and  will  be  al¬ 
tered  between  the  time  this  study  is  presented  and  its  publication.  As 
of  mid-2014,  these  career  fields  included  the  following  (table  8): 

Table  8.  3DXXX  career  fields 


Career  field 
designation 

Career  field  description 

3D0X1 

Knowledge  operations 

3D0X2 

Cyber  systems  operations 

3D0X3 

Cyber  surety 

3D0X4 

Computer  systems  programs 

3D1X1 

Client  systems 

3D1X2 

Cyber  transport  systems 

3D1X3 

Radio  frequency  transmission 
systems 
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Table  8  ( continued ) 


Career  field 
designation 

Career  field  description 

3D1X4 

Spectrum  operations 

3D1X5 

Radar 

3D1X6 

Airfield  operations 

3D1X7 

Cable  and  antenna  systems 

This  table  and  subsequent  graphs  are  compiled  from  research 
team  findings  and  individual  career  field  education  and  training 
plans  (CFETP)  for  the  career  fields  listed.  For  CFETPs,  see  the 
Air  Force  e-publishing  website,  http://www.e-publishing.af.mil, 
and  enter  “CFETP”  in  the  search  engine. 


Of  note,  recent  manpower  discussions  determined  that  the  knowl¬ 
edge  operations  career  field  would  be  split  into  two  pieces,  one  of 
which  will  become  a  personnel  career  field.  In  addition,  the  radar  and 
airfield  operations  fields  listed  above  will  be  moved  out  of  the  cyber¬ 
space  classification  and  into  a  more  general  mission  support  category. 

Developed  and  managed  by  a  single  functional  management  system 
within  HAF/A6,  these  1 1  enlisted  career  fields  share  remarkably  parallel 
career  paths  (fig.  18).  Although  the  specifics  of  the  technical  training 
required  for  each  specialty  are  unique,  the  personnel  are  managed 
similarly.  With  only  one  exception  (spectrum  operations),  all  of  these 
career  fields  are  generally  direct  entry  from  BMT.  Each  has  a  course  of 
initial  instruction  taught  at  Keesler  and  requires  12  months  of  OJT  and 
the  completion  of  a  set  of  CDCs  and  selected  specialty  courses  to  be 
certified  as  a  journeyman,  or  a  5-level  Airman.  Each  career  field  recom¬ 
mends  Airman  Leadership  School  and  a  7-level  or  craftsman  upgrade  in 
the  same  manner  and  at  the  same  time,  and  each  has  a  parallel  develop¬ 
ment  through  the  senior  ranks  to  the  level  of  chief  master  sergeant.  The 
generic  3DXXX  career  pyramid  captures  the  commonalities  across 
these  11  specialties  (fig.  19). 

Initial  training  across  these  11  career  fields  varies  but  generally 
lasts  a  few  months  after  the  completion  of  basic  training.  Airmen  are 
then  assigned  to  their  first  duty  stations,  typically  in  a  communica¬ 
tions  squadron  supporting  a  group  or  wing.  Here,  new  apprentices 
receive  a  minimum  of  12  months  of  OJT  as  they  prepare  for  upgrad¬ 
ing  to  journeyman  status.  Upon  completion  of  the  requisite  CDCs, 
and  in  some  cases  additional  required  courses,  the  Airman  can  be 
certified  at  the  5-level,  or  journeyman. 
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3DX5X  Common  Core  CDCs 


Air  man  Leadership  School 


Cyberspace  Career  Advancement  Course 


€ 


Non-Commissioned  Officer  Academy 


Cyberspace  Superintendent  Course 
Senior  NCO  Academy 


Figure  18.  Career  development  path  of  1B4  and  3DX  enlisted  AFSCs. 

(Developed  by  AFRI  research  team  using  CFETPsof  the  individual  3DXXX 
AFSCs;  CMSgt  Robert  Jackson,  USAF  3DXXX  career  field  manager,  in 
discussion  with  AFRI  research  team,  Air  Staff,  Pentagon,  March-May 
2014;  and  Jackson  to  Dr.  John  P.  Geis,  e-mails,  March-May  2014.  For 
CFETPs,  see  the  Air  Force  e-publishing  website,  http://www.e-publishing 
.af.mil,  and  then  enter  "CFETP"  in  the  search  engine.) 
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Figure  19.  Generic  career  pyramid  for  3DXXX  career  fields.  (Developed 
by  the  AFRI  research  team  from  the  synthesis  of  the  CFETPs  of  the  3DXXX 
career  fields  available  through  USAF  e-publishing,  http://www.e-publishing 
.af.mil.) 

Before  Airmen  can  be  promoted  to  the  first  of  the  NCO  grades, 
they  must  complete  Airman  Leadership  School,  which  they  may  start 
upon  selection  to  the  rank  of  staff  sergeant  or  after  the  four-year  point 
of  active  service.97  Once  Airmen  rise  to  the  NCO  ranks,  the  upgrade 
process  to  craftsman  or  7-level  can  begin.  Again,  regardless  of  which 
subspecialty  the  Airman  is  in,  this  is  the  level  at  which  the  NCO  will 
supervise  journeymen  and  apprentices  as  they  operate  in  the  field. 
For  7-levels,  career  broadening  is  also  a  possibility  in  a  variety  of  po¬ 
sitions,  including  recruiting  or  formal  instructing.  Additionally,  ju¬ 
nior  NCOs  are  encouraged  to  complete  CCAF  associate’s  degrees, 
which  are  desired  at  the  rank  of  technical  sergeant  and  are  a  prereq¬ 
uisite  for  senior  rater  endorsement  for  promotion  consideration  to 
senior  master  sergeant.  Academic  degree  programs,  including  those 
leading  to  advanced  degrees,  are  also  offered  through  AFIT  and  a 
variety  of  universities  with  local  and  on-base  programs  open  to  mili¬ 
tary  personnel.  In  many  of  the  subfields,  pertinent  certifications  can 
be  earned  through  a  combination  of  education,  experience,  and  the 
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passing  of  professional  examinations.  Airmen  are  encouraged  to  pur¬ 
sue  these  certifications  in  addition  to  academic  degrees. 

As  technical  sergeants,  Airmen  train  for  more  senior  leadership 
positions  by  attending  the  NCO  Academy.  Attendance  is  prerequisite 
to  sewing  on  the  rank  of  master  sergeant — normally  around  the  15- 
year  point  in  service  (although  very  rarely  occurring  as  early  as  the 
8-year  point).  By  this  stage,  senior  NCOs  are  ready  for  leadership 
positions  on  various  staffs  or  as  a  squadron  first  sergeant.  Master  ser¬ 
geants  must  attend  the  Senior  NCO  Academy  prior  to  promotion  to 
senior  master  sergeant. 

Upon  promotion  to  senior  master  sergeant,  9-level  superintendent 
upgrade  training  begins.  Senior  master  sergeants  are  placed  in  senior 
NCOIC  or  leadership  positions  on  wing,  NAF,  MAJCOM,  or  joint 
staffs.  Upon  the  individual’s  promotion  to  chief  master  sergeant  and 
completion  of  requisite  capstone  education  requirements,  potential 
assignments  include  functional  manager  on  the  Air  Staff  and  com¬ 
mand  chief  master  sergeant  at  the  wing,  NAF,  or  MAJCOM  level. 
With  only  minor  variation  among  the  subspecialties,  promotion  to 
chief  master  sergeant  averages  between  the  22-  and  23-year  point  of 
an  Airmans  career. 


Summary 

This  discussion  addressed  the  development  of  the  USAF  force 
structure  for  cyberspace  career  fields — specifically  the  14-  and  17-series 
officer  career  fields;  the  1B4,  1N4,  and  3D  enlisted  career  fields;  and 
the  civilian  2210  IT  management  series.  The  detailed  analysis  of  the 
cyber  force  education  and  training  structure  is  of  most  interest  to 
individuals  involved  in  personnel  management.  To  that  end,  we  have 
included  minor  modifications  to  career  developmental  pyramids  and 
changes  within  the  developmental  processes  of  specific  AFSCs. 

However,  from  our  examination,  this  study  makes  several  recom¬ 
mendations  applicable  more  broadly  than  just  to  the  personnel  man¬ 
agement  community: 

•  The  Air  Force  should  create  and  implement  a  cyber  hygiene  de¬ 
velopmental  program  for  new  accessions  before  they  touch  an 
Air  Force  cyber  system.  All  new  accessions — whether  officer, 
enlisted,  or  civilian — must  achieve  an  analysis  level  of  under- 
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standing  of  potential  cyber  threats  to  their  information  systems 
prior  to  becoming  authorized  users  on  Air  Force  networks. 

•  The  service  should  conduct  a  full  curriculum  reevaluation  of  the 
Intelligence  Officer  Course  at  Goodfellow  AFB  for  the  purpose 
of  increasing  the  concentration  in  cyberspace  systems  for  14- series 
initial  development. 

•  Because  experienced  cyberspace  operators  are  a  long  time  in  the 
making  (three  years  in  some  cases)  and  because  we  can  show  a 
strong  correlation  between  a  strong  US  economy  and  cyber¬ 
space  retention  problems,  this  study  recommends  that  HAF/A1 
initiate  cyberspace  retention  incentives  using  a  proactive  or  pre¬ 
dictive  construct  such  as  the  index  of  leading  economic  indica¬ 
tors  rather  than  waiting  for  cyberspace  attrition  issues  to  emerge. 

•  The  Air  Force  senior  language  authority  should  devise  and  im¬ 
plement  specific  language  standards  and  testing  for  cyberspace 
linguistic  needs.  At  minimum,  such  tests  should  include  read¬ 
ing,  speaking,  listening,  writing,  and  computer  coding  in  the 
foreign  language. 

•  This  study  finds  that  despite  the  emergence  of  big  data  /  big-data 
analytics  as  a  major  frontier  in  business  and  industry,  the  Air 
Force  is  unable  to  locate  individuals  who  have  these  skill  sets. 
AFPC  should  devise  and  implement  a  mechanism  for  tracking 
and  managing  the  careers  of  personnel  who  have  this  rare  and 
critical  emerging  skill  set. 

•  The  Air  Force  should  conduct  a  wholesale  overhaul  of  how  it 
tracks  and  hires  civilians  in  the  cyberspace  arena.  Presently,  Air 
Force  cyber  civilians — from  data  entry  operators  to  keyboard 
repair  technicians  to  network  administrators — are  tracked  un¬ 
der  the  2210  civilian  occupational  series.  This  study  recom¬ 
mends  that  the  Air  Force  adopt  and  implement  the  DHS  classi¬ 
fication  framework  embedded  in  the  National  Initiative  for 
Cyberspace  Education  to  categorize  and  track  civilian  cyber¬ 
space  specialization  skills. 

The  following  chart  summarizes  all  recommendations  from  this 
chapter: 
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Recommendations  Summary 

•  Include  a  short  course  in  cyber  hygiene  that  achieves  analysis-level  learn¬ 
ing  objectives  in  cyber  information  assurance  operations  as  part  of  all 
accessions  programs:  BMT,  OTS,  USAFA,  and  ROTC. 

•  Follow-on  studies  should  look  closely  at  the  cyber  intelligence  collec¬ 
tion  field  (1N2)  and  examine  the  enlisted  3DXX  career  field  set  more 
thoroughly. 

•  Although  the  USAF  should  continue  to  work  with  the  DHS  in  implement¬ 
ing  the  NICE  framework,  it  should  not  undertake  wholesale  changes  to  the 
221 0  civilian  occupational  specialty  until  the  framework  is  finalized.  The 
OPM  will  not  complete  reclassification  of  the  cyber  civilian  workforce 
until  at  least  201 8. 

•  Build  a  robust  14XX  website  for  the  14N  career  field,  maintained  by  HQ 
AFPC,  and  clearly  communicate  that  website's  location  to  the  field. 

•  The  functional  manager  for  the  14XX  career  field  should  consolidate  all 
documents  and  management  of  the  career  field  at  the  corporate  USAF 
level  and  work  with  AFPC  to  publish  the  appropriate  USAF-level  guidance. 

•  The  intelligence  community,  including  Twenty-Fifth  Air  Force,  should  re¬ 
examine  the  Intelligence  Officer  Course  to  determine  if  recent  events  in 
cyberspace  warrant  adjustment  of  course  content  and  reallocation  of  time 
across  the  various  intelligence  disciplines  and  competencies. 

•  Cyberspace  14Ns  should  be  assigned  a  minimum  of  two — preferably 
three — back-to-back  cyberspace  tours  before  career  broadening  into 
other  areas  to  reduce  the  training  demand  and  create  more  highly  experi¬ 
enced  cyberspace  intelligence  officers. 

•  Because  the  career-path  tool  is  not  currently  in  active  use  at  AFPC,  give  1 4Ns 
an  SEI  that  tracks  their  specialized  expertise  and  makes  it  easier  for  the  as¬ 
signment  system  to  manage  them  as  the  specialized  resource  they  are. 

•  Economic  trends  should  be  monitored  closely,  and  the  personnel  com¬ 
munity  should  stand  ready  on  short  notice  to  implement  retention  and 
accessions  incentives  should  these  trends  appear  and/or  grow  worse. 

•  Develop  a  cyber-CLEP  exam  for  UCT  for  personnel  with  deeper  cyber 
education  or  experience.  This  test  would  create  additional  on-ramps  for 
individuals  to  enter  the  program  and  potentially  help  avoid  repeated  train¬ 
ing  for  officers  with  technical  degrees,  such  as  CS,  CE,  and  EE.  Those  time 
savings  could  shorten  the  pipeline  for  some,  leaving  the  UCT  course  for 
others  without  the  requisite  education  or  experience. 

•  Due  to  the  need  for  stable  accessions  of  technically  savvy  officers  in  the 
cyber  domain  and  the  stability  that  ROTC  and  the  USAFA  confer  on  of¬ 
ficer  accessions,  we  recommend  that  for  the  time  frame  of  this  study  the 
Air  Force  plan  to  access  all  of  its  cyberspace  officers  entirely  through  the 
USAFA  and  ROTC. 

•  The  DOD  senior  language  authority  should  initiate  planning  for  a  DLPT  writ¬ 
ing  test  using  the  existing  ACTFL  2012  Writing  Proficiency  Test  as  a  guide. 
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Recommendations  Summary  ( continued ) 

•  Establish  a  formal  transition  course  for  operators  on  the  NMTs,  national 
support  teams,  CMTs,  cyber  support  teams,  and  CPTs.This  course  should 
be  critical,  as  is  true  in  the  rated  force,  for  those  who  spend  more  than  12 
months  but  fewer  than  48  months  away  from  the  operations  floor.  Beyond 
a  48-month  absence,  this  study  recommends  attainment  of  full  mission 
requalification. 

•  Make  all  cyberspace  training  ranges  (including  those  at  Keesler  AFB  and 
Hurlburt  Field)  formal  programs  embedded  within  the  POM  process  in 
the  same  manner  as  the  training  ranges  in  the  air  domain.  The  POM  pro¬ 
cess  should  be  used  for  maintenance,  operations,  and  upgrade  of  the  fa¬ 
cilities  on  a  planned  rather  than  ad  hoc  basis. 

•  Prioritize  the  1  B4  career  field  for  allocation  of  tuition  assistance  and  other 
academic  programs  in  those  fiscal  years  when  resources  are  tight. 

•  The  A1  should  make  deliberate  use  of  the  Conference  Board's  Leading 
Economic  Index  (often  called  the  index  of  leading  economic  indicators)  in 
combination  with  existing  manning  and  retention  statistics  to  adjust  selec¬ 
tive  reenlistment  bonuses  and  other  retention  incentives  to  curb  adverse 
manpower  trends  before  manning  reaches  crisis  levels. 

•  Because  language  is  developing  into  a  greater  cyber  enabler,  AFCYBER 
should  evaluate  the  various  languages  in  which  programming  is  cur¬ 
rently  found  and  establish  the  requirements  for  programming-proficient 
linguists.  Once  these  requirements  are  established,  it  should  conduct  an 
analysis  of  alternatives  to  determine  whether  this  need — often  episodic — 
is  best  met  by  military,  civilian,  or  contract  personnel  and  whether  physi¬ 
cal  or  virtual  availability  is  sufficient. 

•  Add  a  computer  coding  component  to  this  linguistic  testing  to  identify 
potential  cyberspace  linguistic  analysts.  Once  individuals  with  these  skills 
are  identified,  establish  a  special  cyber  experience  identifier  for  cyber  lin¬ 
guists  to  enable  tracking  them  in  the  various  personnel  databases. 

•  Since  the  ability  to  read  programming  language  in  a  foreign  tongue  is  not 
a  skill  for  which  all  linguists  are  suited,  manage  those  who  develop  this 
skill  similarly  to  their  1N4X1A  counterparts,  with  an  emphasis  on — but 
not  necessarily  exclusive  use  of — service  in  cyberspace  roles  and  missions. 

•  Until  the  new  cyber  linguist  cohort  is  fully  established,  use  Guard  and 
Reserve  assets  to  address  any  short-term  manning  shortfalls.  As  the  cyber 
linguist  mission  matures,  Guard  and  Reserve  support  in  this  area  may  also 
grow.  To  fill  this  role,  these  components  will  need  to  implement  tracking 
procedures  for  foreign  language  expertise  as  indicated  above. 

•  Maintain  a  tracking  system  of  this  expertise  on  all  operational  cyberspace 
floors  to  ensure  that,  when  needed,  these  experts  can  be  called  upon  in  a 
short  period  of  time — a  condition  analogous  to  quick-reaction  alert  status. 

•  Due  to  the  rapidly  changing  nature  of  the  cyber  domain,  AFCYBER  should 
review  these  language  requirements  and  their  tracking  mechanism  no  less 
than  once  every  two  years  as  part  of  the  formal  POM  cycle. 
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Recommendations  Summary  ( continued ) 

•  Because  cyberspace-specific  skills  overlap  several  specialties,  examine 
the  prospects  of  establishing  a  single  cyberspace  transition  course  for  all 
personnel  returning  to  the  cyberspace  field  after  lengthy  periods  away  or 
working  with  USCYBERCOM  and  the  associated  joint  community  to  cre¬ 
ate  such  a  course. 

•  AFCYBER  and  Twenty-Fifth  Air  Force  should  collectively  and  comprehen¬ 
sively  examine  the  needs  for  big-data  analysts,  establish  formal  require¬ 
ments  to  address  these  needs,  and  then  work  with  A1  to  create  a  mecha¬ 
nism  for  the  identification  and  tracking  of  this  specialized  expertise  within 
the  Air  Force  personnel  system. 
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The  Air  National  Guard,  the  Air  Force 
Reserve,  and  Cyber 

Cyber  is  the  Air  Forces  newest  mission  and  its  least  understood; 
nevertheless,  politicians,  commissions,  and  well-meaning  supporters 
of  this  or  that  military  affiliation  claim  that  their  troops  can  easily 
handle  cyberspace.  In  the  past  two  years,  think  tanks,  commissions, 
and  even  Congress  have  focused  on  the  reserve  components’  (RC) 
cyber  roles. 

A  September  2013  Institute  for  Defense  Analyses  (IDA)  report,  A 
New  Approach  to  Force-Mix  Analysis  (later  referenced  in  the  2014  Na¬ 
tional  Commission  on  the  Structure  of  the  Air  Force  [NCSAF]  report), 
called  for  additional  days  of  active  duty  for  Air  National  Guard  and 
Air  Force  Reserve  cyber  personnel  beyond  the  “normal  39  days.”  Extra 
days,  the  report  claimed,  would  increase  personnel  currency,  better 
use  their  advanced  education  and  training,  and  “lower  RC  hourly 
costs  by  adding  in  more  workdays  at  less  than  drill  pay  rates  and  in¬ 
creasing  [the]  percent  of  time  performing  useful  work.”1 

In  May  2014  a  Reserve  Forces  Policy  Board  (RFPB)  report  for  the 
secretary  of  defense,  Reserve  Component  Use,  Balance,  Cost  and  Savings, 
included  the  recommendation  to  “expand  RC  in  key  skill  areas.”  The 
board  proposed  that  the  DOD  examine  skill  sets  where  the  RCs 
clearly  excel  because  of  their  members’  “civilian  acquired  skills  and 
exposure  to  new  technologies  in  the  workplace.”2 

Finally,  in  late  2013,  the  National  Defense  Authorization  Act  for 
Fiscal  Year  2014  (FY  14  NDAA)  called  for  even  more  reports  on  the 
RCs  and  cyber  “requir[ing]  the  Secretary  of  Defense  to  conduct  a 
mission  analysis  of  [DOD]  cyber  operations,”  including  “an  evalua¬ 
tion  of  the  potential  roles  of  the  reserve  components  [in]  .  .  .  cyber 
operations”  and  a  separate  assessment  by  the  chief  of  the  National 
Guard  Bureau  of  “the  role  of  the  National  Guard  in  supporting  the 
[DOD]  cyber  operations  mission.”3 

The  conclusions  of  all  three  reports  have  common  themes: 

1.  The  RCs  are  cheaper. 

2.  The  RCs  have  relevant  and  exploitable  civilian  skills  for  this 
mission. 

3.  Therefore,  the  Air  Force  should  expand  its  RC  roles  for  cyber. 
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Not  surprisingly,  the  congressionally  chartered  NCSAF  Report  to 
the  President  and  the  Congress  of  the  United  States  (January  2014) 
reached  the  same  conclusions.  Recommendation  25  regarding  cyber¬ 
space  Airmen  states,  “As  it  increases  the  number  of  Airmen  in  career 
fields  associated  with  Cyberspace,  the  Air  Force  should  fill  much  of 
that  demand  with  the  Reserve  Components,  which  are  well  situated 
to  recruit  and  retain  from  the  specialized  talent  available  in  the  com¬ 
mercial  cyber  labor  market.”4  In  April  2014  the  commission  appeared 
before  the  Senate  Armed  Services  Committee,  and  its  testimony  again 
highlighted  increased  Guard  and  Reserve  involvement  in  cyber,  the 
relevant  civilian  cyber  skills  in  those  components,  and  cost  savings.5 

Cost  as  the  Overarching  Factor 

Of  the  three  themes  above,  cost — more  precisely  cost  savings — 
was  cited  most  often  in  these  reports  as  the  raison  d’etre  for  more  RC 
cyber  involvement.  The  most-quoted  source  for  cost  comparisons 
was  the  RFPB’s  2013  report  Eliminating  Major  Gaps  in  DoD  Data  on 
the  Fully-Burdened  and  Life-Cycle  Cost  of  Military  Personnel.  It  con¬ 
cluded  that  “the  cost  of  an  RC  service  member,  when  not  activated,  is 
less  than  one  third  that  of  their  AC  [active  component]  counterpart.”6 
This  revelation  quickly  became  the  mantra  for  calls  to  transfer  many 
types  of  missions  to  the  RCs  and  the  source  for  several  news  stories.7 
However,  the  modifying  phrase  “when  not  activated”  (emphasis 
added)  was  ignored. 

The  Center  for  a  New  American  Security  has  observed  that  “Guard 
and  Reserve  Forces  generally  cost  about  the  same  as  active  forces 
when  they  are  activated.  But  when  they  are  not  activated — which  is 
the  majority  of  the  time — they  cost  approximately  one-third  as 
much.”8  But  its  report  overlooked  the  full-time  support  tail  that 
comes  with  each  Guard  and  Reserve  unit:  the  percentage  of  the  Se¬ 
lected  Reserve  manning  that  is  full-time  support — either  Active 
Guard  and  Reserve  (AGR)  or  military  technicians  (dual  status).9  This 
staffing  is  a  significant  cost  factor  for  peacetime  support.  Since  com¬ 
monly  agreed  upon  RC  cost-savings  data  remains  elusive,  the  lure  of 
cost  savings  alone  should  not  be  the  main  reason  for  a  significant 
transfer  of  cyber  missions  to  the  Guard  and  Reserve. 
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Recommendation:  The  cost  of  active  duty  “when  not  activated” 
should  be  reassessed,  and  RC  costs  upon  activation  should  also  be 
recalculated. 

Civilian  Cyber  Skills  in  the  Reserve  Components 

A  significant  body  of  literature  and  testimony  favors  expanding 
Guard  and  Reserve  cyber  missions  based  on  civilian  skills  they  would 
bring  to  the  fight.10  However,  inconsistencies  in  nomenclature,  prob¬ 
lems  with  projected  mission  sets,  and  even  legal  issues  must  be  sorted 
out  before  the  citizen-Airman  cyber  mission  should  expand.  The  ex¬ 
pertise  and  experience  of  Guard  and  Reserve  personnel  will  be 
needed  and  welcomed,  but  first  there  must  be  some  cogent  plan,  and 
right  now  that  plan  does  not  exist.  As  one  knowledgeable  observer 
noted,  “We  at  CYBERCOM  know  we  have  not  yet  defined  a  surge 
requirement, . . .  but  we  have  so  many  moving  parts  with  . . .  trying  to 
build  existing  capability  .  .  .  that  it’s  really  hard  to  squeeze  a  whole 
heck  more  out.”11 

Some  confusion  exists  about  what  constitutes  a  cyber  mission  and 
who  performs  it.  For  example,  the  NCSAF  report  states  that  43  percent 
of  personnel  (some  1 1 ,000  Airmen)  for  the  cyberspace  superiority  core 
mission  reside  in  the  Guard  and  Reserve,  calling  that  mission  “among 
the  most  integrated  of  the  core  functions.”12  A  closer  look  at  the  num¬ 
bers  reveals  that  most  individuals  are  in  combat  communications 
squadrons — a  part  of  the  cyber  community  but  by  no  means  directly 
involved  in  cyberspace  superiority.13 

Several  names  have  been  proposed  for  Guard  and  Reserve  cyber 
missions;  among  them  are  offensive  cyber  operations,  computer  net¬ 
work  attack,  the  aforementioned  cyberspace  superiority,  and  cyber  de¬ 
fense.14  However,  offensive  cyber  operations  and  computer  network 
attack  are  Title  50  missions,  authority  for  which  is  held  only  at  the 
NSA.15  Moreover,  these  two  are  at  the  far  end  of  the  cyber  operations 
spectrum,  usually  referred  to  as  “computer  network  exploitation.”16 
The  term  cyberspace  superiority  appears  to  be  more  of  an  end  state 
rather  than  a  mission  set  and  is  too  vague  a  term  to  be  of  any  use. 

Cyber  defense  and  computer  network  defense  are  very  similar  terms, 
but  cyber  defense  is  more  inclusive  and  easily  understood.  For  Title  32 
Guard  missions  and  Title  10  Reserve  missions,  cyber  defense  is  a  good 
fit:  it  is  within  the  guidelines  of  Titles  10  and  32,  blends  with  the  efforts 
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of  the  DHS  and  the  Federal  Bureau  of  Investigation,  and  does  not 
overstate  what  the  RCs  can  legally  undertake. 

Recommendation:  Clarify  which  missions  are  currently  being  per¬ 
formed  by  the  Guard  and  Reserve  by  providing  categories  of  cyber 
work,  including  combat  communications,  for  each  RC  unit. 

Recommendation:  Discontinue  the  use  of  the  term  computer  net¬ 
work  attack  (as  well  as  any  other  terms  associated  with  offensive  cy¬ 
ber  missions)  to  describe  a  cyber  mission.  Explicitly  define  those 
missions  within  cyber  (computer  network  defense,  etc.)  that  can  be 
performed  by  Guard  and  Reserve  personnel.  In  particular,  clearly  de¬ 
fine  the  functions  that  Guard  personnel  can  perform  in  Title  32  or 
state  active  duty  (SAD)  status. 

During  its  2013  hearings,  the  NCSAF  heard  much  testimony  about 
the  crossover  of  civilian  cyber  skills  to  military  cyber  missions.  For 
instance,  Maj  Gen  Arnold  Punaro,  USMC,  retired,  stated,  “I  guaran¬ 
tee  you  you’re  going  to  have  better  cyber-skills  in  the  Guard  and  Re¬ 
serve  than  you’re  going  to  be  able  to  sustain  in  the  Active  Compo¬ 
nent.  ...  As  soon  as  they  [active  duty]  finish  their  training  they’re 
going  to  go  to  work  for  Microsoft  and  Google, ...  so  why  can’t  we  put 
them  into  Guard  and  Reserve  units?”17 

Similarities  between  Air  Force  cyber  needs  and  civilian  cyber  ex¬ 
perience  do  exist,  and  there  is  a  solid  case  for  more  RC  personnel  in 
the  DOD  cyber  mix.  However,  the  service  faces  issues  concerning 
civilian  cyber  employees  as  military  cyber  warriors: 

•  Geography.  Most  civilian  cyber  companies  are  clustered  in  the 
metropolitan  DC  area,  near  Seattle,  in  Silicon  Valley,  or  in  San  An¬ 
tonio  (location  of  Twenty- Fourth  and  Twenty-Fifth  Air  Forces).18 
What  about  cyber  missions  elsewhere?  Cyber  protection  teams  are 
being  proposed  for  each  of  the  country’s  10  Federal  Emergency 
Management  Agency  (FEMA)  regions,  but  populating  these  units 
will  require  a  fairly  substantial  training  tail  (see  next  page).19  With¬ 
out  a  cadre  of  experienced  computer  personnel  nearby  to  populate 
these  units,  training  and  accession  issues  will  significantly  slow 
stand-up  and  initial  operational  capability. 

Recommendation:  Collocate  these  CPTs  at  each  FEMA  regional 
headquarters — all  located  in  highly  populated  urban  areas — to  aid  in 
recruiting  a  trained  cyber  workforce  and  help  mitigate  sourcing 
problems  (fig.  20). 


THE  AIR  NATIONAL  GUARD,  THE  AIR  FORCE  RESERVE,  AND  CYBER  141 


Figure  20.  FEMA  regional  headquarters.  (Reproduced  from  Federal 
Emergency  Management  Agency,  "Fire  Management  Assistance  Grants: 
Regional  Contacts,"  30  January  2015,  http://www.fema.gov/fire-manage 
ment-assistance-grants-regional-contacts.) 

•  Training.  Elsewhere  in  this  study  is  a  discussion  of  the  significant 
amount  of  training  necessary  to  obtain  proficiency  and  remain 
proficient  in  the  cyber  world.  Individuals  in  cyber  units  undergo 
refresher  training  roughly  every  90  days  to  stay  current  with  chang¬ 
ing  technologies.  Given  the  part-time  nature  of  the  RC  cadre,  nu¬ 
merous  extra  days  beyond  the  normal  39  duty  days  per  year  would 
be  needed  just  to  maintain  currency.  The  IDA  reported  that  work¬ 
ers  at  one  civilian  cyber  company  needed  refresher  training  “every 
few  weeks  to  keep  up  with  the  dramatic  increases  in  the  sophistica¬ 
tion  of  cyber  attacks.”  It  also  reported  that  an  Air  Force  Reserve 
Command  (AFRC)  analysis  of  a  2011  cyber  business  case  indi¬ 
cated  that  reservists  serving  for  only  60  days  at  a  time  in  cyber  jobs 
“provide  low  benefit.”20  Cyber  skills,  tactics,  techniques,  and  tech¬ 
nology  are  constantly  evolving,  and  90-day  upgrades  are  a  civilian 
industry  norm.  The  training  tail  for  any  cyber  unit  is  significant;  it 
is  even  more  so  for  a  part-time  force. 
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Recommendation:  Increase  training  funds  to  assure  cyber  reserv¬ 
ist  currency. 

•  Numbers.  How  big  should  the  current  force  of  RC  cyber  warriors 
become?  In  2014  six  cyber  squadrons  were  in  the  ANG  and  two 
in  the  AFRC.21  In  early  2014  the  NCSAF  recommended  more, 
and  the  FY  2014  NDAA  called  for  an  immediate  review  to  deter¬ 
mine  an  exact  growth  number.22  As  described  above,  though, 
USCYBERCOM  is  still  trying  to  define  the  exact  end  state  it 
desires. 

Recommendation:  The  NSA  and  USCYBERCOM  should  clearly 
articulate  in  formal  planning  documents  the  cyber  missions  for  the 
Guard  and  Reserve.  In  the  interim,  designate  projected  CPTs  as  Guard 
units  (per  the  Council  of  Governors)  for  each  FEMA  region.  Other¬ 
wise,  halt  further  expansion  until  formal  planning  is  accomplished. 

•  Defense  Support  to  Civil  Authorities  (DSCA).  One  of  the  least 
understood  roles  of  the  military  is  DSCA.  Homeland  security 
and  homeland  defense  are  not  DSCA  but  are  often  confused 
with  it.23  Simply  put,  DSCA  occurs  after  a  disaster  and  at  the  re¬ 
quest  of  local  and  state  authorities  whose  capabilities  for  disaster 
mitigation  have  been  overwhelmed.  Under  the  aegis  of  DSCA, 
the  ANG  (plus  the  Army  National  Guard  and  the  RCs  of  the 
other  services)  would  play  a  large  role  in  the  mitigation  of  any 
cyber  disaster.  USCYBERCOM  has  suggested  that  10  of  its 
planned  20  CPTs  be  Guard  units  assigned  to  FEMA  regions  to 
work  with  local  and  state  officials.24  However,  the  legality  of  the 
Guard’s  performing  domestic  cyber  activities  in  SAD  or  Title  32 
status  will  need  to  be  determined  on  a  case-by-case  basis.  Judge 
advocate  general  guidance  may  be  required  to  make  these  calls, 
and  adding  a  lawyer  to  each  CPT  would  be  a  wise  idea.  Funding 
for  such  missions  is  another  thorny  issue.  One  possible  solution 
is  to  seek  funding  from  the  DHS  in  the  same  manner  that  fund¬ 
ing  for  the  Guard  and  Reserve  flows  from  the  Office  of  National 
Drug  Control  Policy  (ONDCP)  for  counterdrug  support.25 

Recommendation:  Cyber  missions  performed  by  the  Guard  in 
support  of  the  DHS  should  be  funded  by  the  DHS.  Use  the  ONDCP 
counterdrug  funding  example  as  a  guide. 

•  Availability.  Like  many  other  trained  RC  first-responders  (who 
are  civilian  police,  firemen,  and  emergency  medical  services 
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personnel),  Guard  and  Reserve  cyber  warriors  are  citizen- Airmen 
who,  for  the  most  part,  have  full-time  careers.  If  they  are  em¬ 
ployed  in  a  cyber  capacity  as  civilians,  they  may  not  be  available 
for  duty  beyond  their  required  days  because  of  their  other  re¬ 
sponsibilities.  Further,  in  a  cyber  emergency,  they  may  be  needed 
at  their  civilian  jobs  as  much  as  or  more  than  on  active  duty. 
Using  the  civilian  sector  cyber  expertise  of  Guard  and  Reserve 
personnel  as  a  force  enhancer/multiplier  is  an  excellent  option, 
but  as  a  sole  manning  option,  its  effectiveness  may  be  blunted  by 
RC  personnel’s  civilian  demands. 

Recommendation:  Guard/Reserve  recruiting  for  cyber  units  should 
not  focus  exclusively  on  employees  from  the  computer/ cyber  security 
industry.  Although  they  may  have  the  proper  background,  conflicts  of 
interest  could  inhibit  their  full  utilization  in  an  emergency. 

Summary 

The  Guard  and  Reserve  partnership  with  the  active  Air  Force 
should  extend  to  the  cyber  domain,  just  as  it  does  for  air  and  space. 
However,  the  rapid  growth  of  RC  cyber  units,  coupled  with  the  recent 
(2010)  stand-up  of  USCYBERCOM,  means  that  the  roles  and  mis¬ 
sions  of  both  the  Guard  and  Reserve  are  only  now  being  understood. 
Cost  savings  alone  is  an  invalid  reason  to  stand  up  more  RC  cyber 
units.  Solid  requirements  must  drive  force  presentation,  and  policy 
makers  and  military  planners  alike  must  have  access  to  accurate  cost 
calculations.  Using  the  civilian  expertise  of  RC  cyber  warriors  is  an 
attractive  selling  point  for  RC  cyber  units,  but  people  in  civilian  cyber 
first-responder  jobs  or  in  damage-mitigation  roles  cannot  be  counted 
on  to  choose  between  their  civilian  careers  and  activation.  Specific 
missions  in  support  of  USCYBERCOM  naturally  fall  into  its  funding 
line.  However,  the  DHS  must  be  a  source  for  funding  when  the  task 
clearly  supports  its  activities. 


Recommendations  Summary 

•  Reassess  the  cost  of  active  duty  "when  not  activated,"  and  recalculate  RC 
costs  upon  activation. 

•  Clarify  missions  that  the  Guard  and  Reserve  are  currently  performing  by 
providing  categories  of  cyber  work,  including  combat  communications, 
for  each  RC  unit. 
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Recommendations  Summary  ( continued ) 

•  Discontinue  the  use  of  the  term  computer  network  attack  (as  well  as  any 
other  terms  associated  with  offensive  cyber  missions)  to  describe  a  cyber 
mission.  Explicitly  define  those  missions  within  cyber  (computer  network 
defense,  etc.)  that  can  be  performed  by  Guard  and  Reserve  personnel.  In 
particular,  clearly  define  the  functions  that  Guard  personnel  can  perform 
in  Title  32  or  SAD  status. 

•  Collocate  CPTs  at  each  FEMA  regional  headquarters — all  located  in 
highly  populated  urban  areas — to  aid  in  recruiting  a  trained  cyber  work¬ 
force  and  help  mitigate  sourcing  problems. 

•  Increase  training  funds  to  assure  cyber  reservist  currency. 

•  The  NSA  and  USCYBERCOM  should  clearly  articulate  in  formal  planning 
documents  the  Guard  and  Reserve  cyber  missions.  In  the  interim,  des¬ 
ignate  projected  CPTs  as  Guard  units  (per  the  Council  of  Governors)  for 
each  FEMA  region.  Otherwise,  halt  further  expansion  until  formal  plan¬ 
ning  is  accomplished. 

•  The  DHS  should  fund  the  Guard's  cyber  accessions  in  support  of  the  DHS. 
Use  the  ONDCP  counterdrug  funding  example  as  a  guide. 

•  Recruiting  for  cyber  units  should  not  focus  exclusively  on  employees  from  the 
computer/cyber  security  industry.  They  may  have  the  proper  background,  but 
conflicts  of  interest  could  inhibit  their  full  utilization  in  an  emergency. 
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A8,  January  2011  (ibid.,  12nll). 

21.  Two  examples  illustrate  the  patchwork  approach  to  RC  cyber  unit  stand-ups. 
First,  the  118th  Airlift  Wing  at  Nashville  is  converting  some  elements  to  form  a  cyber 
unit.  During  an  interview  with  FLAF/A2D  (ISR  Strategy,  Integration,  and  Doctrine), 
we  were  told  that  the  unit  called  their  office,  announced  that  the  unit  was  “converting 
to  cyber,”  and  asked  for  “paperwork”  for  cyber  positions  (23  July  2014).  Second,  the 
AFRC  activated  a  classic  associate  unit  in  support  of  the  70th  Intelligence  Wing  (IW) 
at  Fort  Meade  last  fall.  This  squadron  was  created  at  the  request  of  the  70  IW/CC  to 
resolve  the  “administrative  problems”  associated  with  the  management  of  its  indi¬ 
vidual  mobilization  augmentee  (IMA)  force.  To  stand  up  the  100-person  unit,  189 
IMA  billets  were  traded  for  100  traditional  reserve  drilling  positions,  including  a 
full-time  cadre  of  10  AGRs.  Heikkinen  to  Conway,  e-mails. 

22.  The  NCSAFs  Report  to  the  President  proposes  a  shift  of  450  positions  of 
planned  growth  in  the  cyber  core  function  to  the  RCs  (p.  101).  The  commission  also 
recommends  moving  some  “3,875  Offensive  Cyber  Operations  (OCO)-type  intel 
and  data  analysis  positions”  to  the  Guard  and  Reserve  within  the  global  integrated 
ISR  core  function  (ibid.).  This  latter  shift — about  eight  times  larger  than  the  one 
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from  the  cyber  core  function — is  particularly  troubling,  given  that  OCO  is  a  Title  50 
function  not  delegated  to  the  states. 

23.  The  DOD  is  the  lead  federal  agency  for  homeland  defense,  and  the  DHS  is 
the  lead  federal  agency  for  homeland  security. 

24.  For  the  number  of  proposed  USCYBERCOM  CPTs,  see  the  briefing  “USCY- 
BERCOM  Cyber  Mission  Force,”  slide  5.  The  number  of  CPTs  that  the  Council  of 
Governors  has  projected  for  the  Air  Guard  /  FEMA  region  beddown  comes  from 
Zuehlke  to  Conway,  e-mail. 

25.  McKinney,  “National  Solution,”  11. 


Chapter  7 

Educating  and  Training  Cyber  Forces 

Leadership  tomorrow  depends  on  how  we  educate  our  stu¬ 
dents  today — especially  in  science,  technology,  engineer¬ 
ing  and  math. 

— President  Barack  Obama,  16  September  2010 

To  compete  with  both  advanced  nation-state  and  nonstate  adver¬ 
saries,  the  Air  Force  and  DOD  at  large  require  a  cadre  of  cyber  op¬ 
erators  capable  of  reacting  to  novel  threats  in  novel  situations.  Educa¬ 
tion  is  the  foundation  on  which  the  Air  Force  can  build  a  cyber  force 
to  achieve  this  objective.  Ideally,  the  Air  Force  would  reach  this  goal 
by  selecting  individuals  who  have  specialized  in  the  science,  technol¬ 
ogy,  engineering,  and  mathematics  fields;  training  them  in  the  art 
and  science  of  cyber  warfare;  providing  them  experience  in  opera¬ 
tions;  and  then  continuing  their  education  with  an  advanced  aca¬ 
demic  degree  (AAD)  in  a  STEM  discipline.  Unfortunately,  we  are  not 
there  yet.  A  significant  concern  discovered  during  our  research  is  the 
Air  Force’s  emphasis  on  ramping  up  the  cyber  workforce  with  trained 
operators  who  are  commercially  certified.  At  first  blush,  this  ap¬ 
proach  seems  prudent.  However,  the  training  path  tends  to  produce 
officers  with  rote-memorized  skills  versus  flexible,  critically  thinking 
cyber  warriors  prepared  to  meet  adaptive  adversaries.  The  Air  Force, 
DOD,  and  national  security  community  at  large  must  focus  efforts  to 
attract  personnel  educated  in  STEM  fields  as  well  as  those  in  the  arts 
with  a  proclivity  for  cyber  operations  (STEAM)  for  missions  in  a  con¬ 
tested  environment. 

When  considering  the  skills  that  a  student  learns  in  a  CS  curricu¬ 
lum,  a  CE  or  systems  engineering  (SE)  degree  might  be  better  suited 
for  the  OCO  and  DCO  mission  sets  while  CS  may  be  preferable  for 
the  DODIN  mission  space.  The  fields  of  computer,  electrical,  and  sys¬ 
tems  engineering  differ  from  CS,  which  involves  the  methods  for  rep¬ 
resenting,  transforming,  and  transmitting  information.  The  some¬ 
what  overlapping  fields  of  CE,  EE,  and  SE  address  the  mapping  of 
computing  processes  onto  mechanisms  that  control  platforms  or 
physical  infrastructure.  Assuring  Air  Force  core  functions  and  missions 
entails  the  understanding  of  mission  dependence  on  cyberspace.  This 
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dependence  goes  beyond  traditional  CS  disciplines  of  computer  net¬ 
works.  The  embedded  processes  and  controllers  on  weapons  plat¬ 
forms,  design  of  resilient  computing  architectures,  and  protection  of 
the  USAF’s  critical  infrastructure  require  an  interdisciplinary  under¬ 
standing  of  computer  systems  and  their  interactions  with  humans. 
An  emphasis  on  training  in  traditional  CS  disciplines  (explored  in 
depth  throughout  this  chapter)  is  a  significant  point  of  concern  in  our 
study.  An  overview  of  the  differences  between  education  and  training 
is  therefore  our  starting  point.  We  then  assess  the  United  States’  place 
in  the  world  in  terms  of  STEM  education  while  understanding  the 
levels  of  education  within  the  current  USAF  cyber  workforce  and  the 
curricula  and  facilities  that  exist  to  support  the  education  and  training 
of  our  cyber  warriors.  Overall,  the  Air  Force  needs  to  recognize  that 
an  educated  cyber  workforce  is  imperative  to  assure  Air  Force  mis¬ 
sions  beyond  current  IT  paradigms  and  embrace  education  as  an  in¬ 
tegral  aspect  of  the  career  development  of  cyber  operations  personnel. 

Education  versus  Training 

Distinguishing  between  cyber  education  and  training  is  impor¬ 
tant.  We  use  Bloom’s  Taxonomy  as  the  representative  model  of  the 
stages  of  higher-order  thinking.1  Civilian  and  military  curriculum 
developers  use  this  taxonomy  to  create  material  that  will  expose  stu¬ 
dents  to  activities  requiring  them  to  acquire  and  remember  informa¬ 
tion  and  then  demonstrate  and  practice  their  understanding  of  the 
knowledge  by  applying  it  to  create  new  knowledge.  Figure  21  shows 
examples  of  cyber  tasks  that  would  be  demonstrated  at  the  levels  of 
Bloom’s  Taxonomy. 

Cyber  education,  as  defined  here,  consists  of  academic  degrees  in 
related  disciplines  and  actual  time  spent  in  the  discipline  itself.  For  pur¬ 
poses  of  simplicity,  we  defined  a  cyber-trained  officer  as  one  certified  in 
following  procedures  and  tested  on  skills  offered  through  certification 
programs  accredited  by  various  vendors.  These  certificates  are  indi¬ 
cators  of  the  knowledge  and  perhaps  comprehension  levels  in  the 
taxonomy  and  of  who  may  be  able  to  follow  a  script — useful  in  gaining 
awareness  of  the  cyberspace  arena.  This  training  is  touted  as  industry 
best  practice  and  is  currently  used  to  measure  skills  within  the  career 
field.  The  reality  is  that  industry-standard  training  is  inadequate  in  to¬ 
day’s  threat  environment.  A  case  in  point  is  the  North  Korean  data  theft 
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at  Sony  revealed  in  November  2014.  A  crew  of  trained  operators  could 
not  protect  the  core  cyber  infrastructure  of  the  corporation  against  a 
nation-state  adversary.2  This  case  demonstrated  that  “trained  person¬ 
nel”  do  not  necessarily  equate  with  personnel  who  can  react  to  novel 
threats  and  apply  their  knowledge  in  new  situations.  The  hacking  of  An¬ 
them,  Inc.  is  another  case  in  point  on  the  limitations  of  risk  mitigation 
frameworks,  such  as  the  NIST  Cybersecurity  Framework.  In  that  case, 
the  industry  “best  practices”  implemented  on  complex  systems  by 
trained  personnel  to  defend  against  advanced  adversaries  did  not  fit  the 
bill  and  gave  a  false  sense  of  security.3  Unless  educated  with  critical 
thinking  skills  and  a  formal  course  of  study  in  a  cyber  specialty,  person¬ 
nel  will  not  reach  the  levels  of  evaluation  and  creation  (synthesis)  in 
Blooms  Taxonomy  to  compete  with  nation-state-level  adversaries. 


Creation 

Design  software  or  hardware  to  perform  a  specific  task. 
Revise  and  process  to  improve  meeting  requirements. 


Evaluation 

Select,  explain,  and  justify  the  most  effective  solution  to  a 
cyber  intrusion. 


Analysis 

Gather  information  about  a  situation,  and  use  logical 
deduction  to  troubleshoot  a  situation. 


Application 

Use  a  manual  to  apply  learned  skills  to  evaluate  the 
reliability  of  a  computer  network. 


Understanding 

Explain  in  one's  own  words  the  steps  for  performing  a 
penetration  test. 

Remembering 

Recite  a  cyber  policy,  know  basic  rules,  or  repeat  a 
process  from  memory. 


Figure  21.  Cyber  tasks  at  levels  of  Bloom's  Taxonomy.  (Adapted  from 
Benjamin  S.  Bloom  and  David  R.  Krathwohl,  Taxonomy  of  Educational 
Objectives ,  Book  1:  Cognitive  Domain  [Reading,  MA:  Addison  Wesley 
Publishing  Company,  1984].) 


In  comparisons  with  foreign  countries,  we  found  that  allied  and 
adversarial  nations  alike  seek  to  craft  a  cadre  of  cyber  warriors  who 
hold  masters  degrees  rather  than  trained  cyber  automatons.  This  desire 
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becomes  apparent  when  one  compares  the  profile  of  cyber  officers.  In 
France,  for  example,  the  ideal  cyber  officer  is  a  “holder  of  [a]  Masters 
in  Cyber  Defense,  is  an  expert  in  cyber  operations  and  crisis  manage¬ 
ment,  .  .  .  controls  [the]  environment  in  the  humanities  and  social 
sciences  in  his  field  and  has  gained  a  good  technical  knowledge  of 
networks,  with  systems  information  and  their  related  materials.”4 
This  statement  indicates  that  France  is  in  the  process  of  developing 
well-rounded  cyber  warriors  with  an  interdisciplinary  background. 
Such  education  allows  operators  to  holistically  appreciate  the  policy 
behind  the  kinetics  as  well  as  create  innovative  solutions  not  stove- 
piped  in  one  discipline. 

Unlike  our  adversaries,  the  United  States  faces  a  void  of  cyber- 
educated  personnel  able  to  think  dynamically  in  unusual  situations. 
When  combined  with  the  declared  doctrinal  intent  of  Russia,  China, 
and  Iran  to  operationalize  the  cyber  domain  for  military  purposes, 
this  situation  is  worrisome  (fig.  22). 


2010  Military  Doctrine: 

"integrated  use  of  military  force  and  non-military 
capabilities,  and  a  greater  role  for  information  warfare" 


2011  Defense  White  Paper: 
"combat  capability  to  win  local  wars 
in  conditions  of  informationization" 


2012  Supreme  Council  of  Cyberspace: 
tasked  with  the  coordination  of  national  cyber  warfare 


Figure  22.  Cyber  in  foreign  military  doctrine  and  strategy.  (Compiled  from 
Carnegie  Endowment,  "The  Military  Doctrine  of  the  Russian  Federation,"  5 
February  2010,  http://carnegieendowment.org/files/2010russia_military_doc 
trine.pdf;  "China's  National  Defense  in  2010,"  Information  Office  of  the  State 
Council,  People's  Republic  of  China,  Beijing,  March  2011,  http://news.xin 
huanet.com/english201 0/china/2011-03/31/c_1 3806851.htm;  and  Gabi 
Siboni  and  Sami  Kronenfeld,  "Iran's  Cyber  Warfare,  INSS  [Institute  for  Na¬ 
tional  Security  Studies]  Insight  No.  375,  15  October  2012.) 
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International  CS  competitions  demonstrate  that  the  recruitment 
pool  within  these  countries  is  deeper  in  STEM  expertise.  Thus,  as 
indicated  in  the  performance  of  US  teams  in  international  program¬ 
ming  competitions,  those  who  may  seek  to  disrupt  Air  Force  mis¬ 
sions  and  destroy  critical  infrastructure  will  be  drawing  from  this 
pool  of  students  steeped  in  STEM  and  cyber.  On  the  adversarial  side, 
Timothy  Thomas  describes  the  Chinese  Information  Security  Uni¬ 
versity,  which  specializes  in  military  information  security  with  a  rig¬ 
orous  emphasis  on  science,  technology,  and  mathematics  in  cyber 
operations.5  Simply  put,  a  trained  Air  Force  operator  will  not  be  com¬ 
petitive  on  the  cyber  battlefront  against  an  adversary  trained  in  the 
military  arts  and  sciences  and  educated  in  the  mathematics  and  sci¬ 
ence  of  cyber  operation.6  Advanced  mathematics,  computer  pro¬ 
gramming,  and  teamwork  provide  the  theoretical  foundation  essen¬ 
tial  to  maneuvering  and  adjusting  to  the  dynamic  cyber  domain. 

This  point  is  quantified  in  figure  23  with  the  results  of  the  Associa¬ 
tion  for  Computing  Machinery  International  Collegiate  Program¬ 
ming  Contest  (ACM-ICPC).  Such  competitions  offer  insight  into  the 
divergence  between  the  level  of  cyber  education  and  prowess  of  stu¬ 
dents  internationally  versus  that  of  students  at  US  universities.  The 
ACM-ICPC  results  are  of  particular  interest  as  the  competition  takes 
“teams  of  three  students  represent  [ing]  their  universities  in  multiple 
levels  of  regional  competition.  Volunteer  coaches  prepare  their  teams 
with  intense  training  and  instruction  in  algorithms,  programming, 
and  teamwork  strategy.”7  Russia  and  China  dominated  the  2014  com¬ 
petition  while  the  United  States  failed  to  break  into  the  top  10. 

The  International  Informatics  Olympiad  is  yet  another  benchmark 
that  “offers  an  opportunity  to  bring  together  the  accumulated  knowl¬ 
edge  and  experiences  from  a  number  of  events  on  teaching  algo¬ 
rithms  and  programming.”8  At  first  glance,  figure  24  appears  to  indi¬ 
cate  that  the  United  States  fares  quite  well  against  Russia  and  China. 
However,  a  further  look  reveals  that  this  chart  shows  total  medal 
count  and  not  a  placement  within  the  group  based  on  top  perform¬ 
ers.  For  example,  Iran  has  a  considerably  higher  total  of  silver  and 
bronze  medals.  This  figure  also  shows  that  other  countries  are  rapidly 
achieving,  if  not  surpassing,  US  levels  of  cyber-sawy  performance. 
As  a  national  snapshot,  the  picture  is  grim.  When  one  delves  into 
levels  of  STEM  education  within  the  current  Air  Force  cyber  work¬ 
force,  the  picture  becomes  bleaker  given  that  if  the  services  missions 
fail,  loss  of  life  could  be  the  consequence. 
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Figure  23.  2014  ACM  programming  competition.  (Compiled  from  As¬ 
sociation  for  Computing  Machinery  International  Collegiate  Program¬ 
ming  Contest,  "World  Finals,"  2014,  http://icpc.baylor.edu/worldfinals.) 
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Figure  24.  Informatics  Olympiad  medal  totals,  1988-2014.  (Developed 
from  data  from  International  Olympiad  in  Informatics  website,  http:// 
www.ioinformatics.org/index.shtml.) 
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Levels  of  Education  within  the  USAF  Cyber  Workforce 

This  study  found  a  severe  lack  of  cyber-related  degrees  within  the 
core  cyberspace  operations  cadre  of  17D  network  operations  officers, 
14N  intelligence  officers,  and  the  1B4,  1NXXX,  and  3DXXX  enlisted 
fields.  Of  those  accessed  into  the  cyber  career  field,  only  one  in  three 
(35  percent)  have  a  cyber-related  bachelor’s  degree.  A  majority  of 
17- series  career  field  majors  and  colonels  have  AADs,  but  historically 
only  10  percent  of  those  degrees  are  cyber  related.9  A  breakdown  of 
bachelor’s  degrees  and  AADs  follows  (tables  9  and  10,  fig.  25). 

Table  9.  17D  bachelor's  degrees 


Subject 

Percentage  of  total 

Computer  science 

8.7% 

Electrical  engineering 

1 .5% 

Computer  engineering 

0.4% 

Any  cyber  degree 

10.6% 

Of  these,  NSA  accredited 

43.5% 

Developed  from  Air  Force  Personnel  Center,  Personnel  Database,  Extracts 
of  Officer  Data,  1995-2014. 


Table  10.  17D  master's  degrees 


Subject 

Percentage  of  total 

Computer  science 

24.7% 

Electrical  engineering 

8.4% 

Computer  engineering 

2.0% 

Any  cyber  degree 

35.0% 

Of  these,  NSA  accredited 

1 .4% 

Developed  from  Air  Force  Personnel  Center,  Personnel  Database,  Extracts 
of  Officer  Data,  1995-2014. 
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Figure  25. 17D  overall  degrees.  (Reproduced  from  Air  Force  Personnel 
Center,  Personnel  Database,  Extracts  of  Officer  Data,  1995-2014.) 

The  United  States  has  the  greatest  higher  education  system  in  the 
world.  Research  universities  continue  their  lead  in  developing  ad¬ 
vanced  information  and  communication  technology.  Unfortunately, 
very  few  Air  Force  accessions  come  from  universities  with  top  cyber 
programs  (fig.  26).  Of  all  officers  brought  into  the  cyber  profession, 
the  Air  Force  has  averaged  about  three  officers  per  year  from  highly 
recognized  universities  in  the  field  (table  11).  We  judge  that  this  prob¬ 
lem  can  be  addressed  with  the  right  policies  and  procedures  in  place. 

United  States  Air  Force  Academy 

Two  years  ago  AFPC  was  given  responsibility  for  determining  AFSCs 
for  ROTC  and  USAFA  cadets.  Preference,  academic  rank,  and  major 
are  the  three  main  determinants  of  AFSCs — along  with  the  needs  of 
the  Air  Force.  Currently,  the  Air  Force  is  asking  the  USAFA  to  pro¬ 
duce  50  17D-series  Airmen  per  year.  EE/CE  is  the  third-least-popular 
major,  and  CS  is  the  fifth-least  popular. 

We  wanted  to  determine  both  USAFA  cadet  interest  in  cyber  ca¬ 
reer  fields  and  the  quality  of  students  interested  as  measured  by  GPA. 
We  found  the  number  of  cyber-degreed  cadets  who  chose  17D  first 
among  nonrated  AFSCs  and  divided  it  by  the  number  of  17Ds  the  Air 
Force  has  accessed  from  the  academy  (currently,  all  cadets  can  be¬ 
come  17Ds,  at  least  theoretically)  from  201 1  to  2014.  Figure  27  shows 
the  percentage  of  USAFA  cyber  majors  who  selected  17D  as  their  first 
choice.  Figure  28  indicates  that  those  with  a  17D  preference  at  the 
USAFA  generally  have  a  lower  GPA  than  other  nonrated  line  officer 
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career  fields  and,  even  more  worrisome,  that  the  17D  career  field  is 
among  the  last  choices  of  nonrated  officers.  This  finding  cannot  be 
explained  by  relative  difficulty  of  major  because  cyber  majors  have 
GPAs  higher  than  the  average  GPAs  of  the  academy  (table  12).  Delv¬ 
ing  deeper  into  the  data,  one  discovers  that  the  17D  career  field  is 
popular  with  CS  majors  but  unpopular  with  CE/EE  majors  (fig.  29). 


Top  10  Global 
Universities  for  STEM 


NSA  Cyber  Operations- 
Accredited  Universities 


MIT 

ALIT(GR) 

Stanford  University 

— 

Auburn  University  (UG/GR) 

UC-Berkley 

Carnegie  Mellon  (GR) 

Cal  Tech 

Dakota  State  University  (UG) 

Princeton  University 

Mississippi  State  University  (GR) 

University  of  Cambridge 

Naval  Postgraduate  School  (GR) 

University  of  Oxford 

Northeastern  University  (UG) 

ETH  Zurich 

- — 

Polytechnic  School  of  Engineering  (GR) 

Imperial  College  London 

Townson  University  (UG) 

UCLA 

- 

US  Military  Academy  (UG) 

University  of  Cincinnati  (GR) 

University  of  New  Orleans  (UG/GR) 

University  of  Tulsa  (UG/GR) 

GR  Graduate  Program 

UG  Undergraduate  Program 

Figure  26.  Top-ranked  cyber  programs  worldwide.  (Developed  from 
[left]  Times  Higher  Education  World  University  Rankings,  "Subject  Ranking 
2013-14:  Engineering  and  Technology,"  2014,  https://www.timeshigher 
education.co.uk/world-university-rankings/2014/subject-ranking/engi 
neering-and-IT#;  and  [right]  NSA,  "List  of  Centers  of  Academic  Excellence 
for  Cyber  Operations,"  2014,  https://www.nsa.gov/academia/nat_cae_cy 
ber_ops/nat_cae_co_centers.shtml.) 


Table  11.  Cyber-educated  accessions  from  top  universities 


|  2009 

2010 

2011 

2012 

2013  | 

Developed  from  Office  of  the  Registrar,  Holm  Center,  Maxwell  AFB,  AL,  March  2014. 
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Figure  27.  USAFA  cyber  major  preference  for  17D.  (Developed  from 
Cadet  Administrative  Management  System,  Office  of  the  Registrar, 
United  States  Air  Force  Academy,  Colorado  Springs,  CO,  August  2014.) 
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Figure  28.  USAFA  nonrated  preferred  AFSC  and  GPA.  Chart  indicates 
decreasing  order  of  preference  from  left  to  right.  (Developed  from  Ca¬ 
det  Administrative  Management  System,  Office  of  the  Registrar,  United 
States  Air  Force  Academy,  Colorado  Springs,  CO,  August  2014.) 


Table  12.  Average  GPAs  of  USAFA  cyber  majors  versus  all  USAFA  cadets 


Major 

Average  GPA 

Electrical  engineering 

3.25 

Computer  engineering 

3.09 

Computer  science 

3.02 

Average  of  all  USAFA  cadets 

2.97 

Developed  from  Cadet  Administrative  Management  System, 
Office  of  the  Registrar,  United  States  Air  Force  Academy,  Colo¬ 
rado  Springs,  CO,  August  2014. 
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Computer  Science  First-Choice  AFSC  Computer/Electrical  Engineering  First-Choice  AFSC 


■  17D 

■  14N 
Other 


■  62E 

■  17D 
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Figure  29.  USAFA  cyber  majors'  first-choice  nonrated  AFSCs.  Computer 
science  major  (left)  and  CE/EE  major  (right)  first-choice  AFSCs.  (Developed 
from  Cadet  Administrative  Management  System,  Office  of  the  Registrar, 
United  States  Air  Force  Academy,  Colorado  Springs,  CO,  August  2014.) 

The  AFSC  choice  is  not  an  easy  fix.  All  USAFA  cadets  are  free  to 
select  any  major  they  desire,  making  it  difficult  to  push  cadets  into  spe¬ 
cific  disciplines.  Cadets  complete  their  dream  sheet  during  their  senior 
year,  and  about  half  of  all  USAFA  graduates  choose  a  rated  AFSC. 
This  statistic  holds  true  for  CS,  CE,  and  EE  majors.  Top-performing 
students  are  given  preference  in  the  assignment  process;  those  choos¬ 
ing  to  fly,  if  medically  qualified,  generally  get  their  wish.  In  addition, 
many  technical  majors  essentially  wash  out  and  are  directed  to 
broader  majors.  Consequently,  graduates  from  technical  majors  who 
are  more  apt  to  fill  17S  slots  tend  to  have  lower  GPAs  than  their  class¬ 
mates  who  fill  rated  slots,  resulting  in  the  cyber  career  field  receiving, 
on  average,  a  lower-quality  graduate. 

The  USAFA  is  creating  a  new  computer  and  network  security 
(CNS)  degree  that  will  combine  CS,  computer  operations,  and  soft¬ 
ware  development.  The  degree  is  tied  to  NSA  requirements,  and  the 
academy  is  seeking  recognition  as  a  cyber  operations  center  of  excel¬ 
lence.  Before  the  new  major  was  advertised,  19  cadets  showed  up  to 
enroll.  The  CS  faculty  is  understandably  excited  about  this  unsolic¬ 
ited  demand  signal.  As  of  spring  2014,  the  USAFA  had  58  declared 
majors  in  CS  and  CNS  for  the  class  of  2017.  If  normal  attrition  rates 
hold,  the  USAFA  expects  over  40  of  them  to  graduate — with  half  of 
these  graduates  filling  rated  slots,  leaving  approximately  20  CS  and 
CNS  graduates  to  fill  the  USAFA’s  17S  quota.  The  hope  is  that  the  rest 
of  the  USAFA  quota  will  be  filled  by  CE/EE  and  other  departments. 

The  consensus  among  USAFA  faculty  is  that  cadets  majoring  in 
fields  other  than  CS/EE/CE  are  unprepared  for  the  complex  side  of 
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cyber.  Although  they  can  handle  the  management  of  base  communi¬ 
cations,  they  do  not  have  the  necessary  educational  background  to 
operate  successfully  in  the  cyber  domain.  The  17D/17S  split  should 
help  if  it  keeps  personnel  in  proper  billets.  Otherwise,  the  attrition 
problem  and  the  desire  to  avoid  17D/S  will  not  get  fixed. 

The  USAFA  has  several  initiatives  to  generate  more  interest  in  the 
17D/S  career  fields.  To  improve  cadets’  interest  in  the  cyber-focused 
majors,  the  CS  department  has  revamped  its  Introduction  to  Com¬ 
puting  course,  which  all  cadets  take.  It  has  incorporated  simulated 
OCO  and  DCO  into  the  course — making  it  much  more  popular  and 
increasing  the  number  of  students  who  choose  a  cyber-focused  major. 
Moreover,  cadets  are  offered  some  summer  opportunities.  Anually, 
the  NSA,  National  Reconnaissance  Office  (NRO),  and  MIT’s  Lincoln 
Labs  each  receive  two  cadets  who  complete  summer  research  proj¬ 
ects.  Other  summer  cyber  research  opportunities  include  Twenty- 
Fourth  Air  Force,  Nellis  AFB,  and  the  DHS  Cadet  Summer  Research 
Projects  program.  This  program  allows  cadets  to  conduct  cyber  re¬ 
search  alongside  industry  leaders  such  as  Intel,  IBM,  and  Sharp  at  the 
DHS  Center  of  Innovation  on  the  USAFA  campus.  Interestingly,  every 
CS  cadet  sent  to  the  NSA  for  the  summer  has  come  back  and  selected 
17D  as  his/her  primary  AFSC  choice. 

One  roadblock  to  the  daunting  problem  of  filling  17-series  career 
fields  is  a  career  field  perception  problem  at  the  USAFA.  As  of  this 
study,  it  was  unclear  whether  this  problem  will  persist  after  the  career 
field  split.  In  the  past,  when  CS/CE/EE  students  were  assigned  to  17D 
involuntarily,  enrollment  in  those  majors  declined  30  percent.  Thus, 
such  a  practice  has  severe  repercussions  for  those  areas  of  study.  Re¬ 
cently,  of  30  graduated  or  graduating  students  from  the  USAFA  cyber 
program,  only  5  chose  the  17-series  AFSC,  and  faculty  described  the 
year  as  a  “banner”  one.  Therefore,  in  most  years,  the  percentage  of 
cadets  with  technical  degrees  who  choose  the  17  series  is  even  lower. 

USAFA  students  do  not  view  the  17-series  career  field  as  an  attrac¬ 
tive  long-term  career  choice.  Interviews  with  cadets  offered  insights 
into  their  motivations  and  perceptions  about  the  17-series  AFSC.  The 
only  less-popular  AFSC  is  13N  (nuclear  and  missile  operations). 
Most  CS/EE/CE  cadets  are  afraid  they  will  get  “stuck”  serving  as  a 
base  communications  squadron  officer  instead  of  doing  17-series 
work,  and  getting  a  (formerly)  “A”  or  “B”  shred  is  not  necessarily 
based  on  skill  but  oftentimes  on  many  other  factors.  The  CS  and  CE 
departments  verified  this  perception  as  widespread. 
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That  belief  may  have  some  truth  behind  it.  A  general  agreement  exists 
among  interviewed  USAFA  faculty  that  17-series  cadets  tend  to  lose 
their  desire  to  stay  on  active  duty  around  the  six-year  point.  At  this 
point — after  17-series  cadets  have  been  assigned  to  base  communications 
and  their  cyber  warfare  skills  have  eroded — they  cannot  return  to  a  cyber¬ 
operations  floor.  As  noted  earlier,  the  17D/17S  split  may  help  overcome 
the  negative  perception  of  the  career  field  among  technical  majors,  but 
more  should  be  done  to  combat  how  the  career  field  is  viewed. 

Recommendation:  The  best  way  to  increase  interest  in  the  17-series 
AFSC  is  for  USAFA  customers  to  tell,  and  then  prove  to,  cadets  that 
they  have  good  jobs  for  them.  Knowing  that  challenging  jobs  exist  in 
the  field  will  drive  up  interest. 

Recommendation:  Creating  a  summer  course  for  cadets  would  be 
useful  as  a  means  of  enticing  them  into  the  career  field.  Currently,  one 
does  not  exist  (it  was  eliminated  once  the  1 10  course  was  updated  and 
offered  to  all  cadets  in  their  first  year). 

US  Air  Force  Academy  Cyber  Range 

The  academy’s  range  receives  extensive  use.  The  freshman  Intro¬ 
duction  to  Computing  class  is  now  taught  at  the  range,  and  the  USA- 
FA’s  cyber  competition  team  also  competes  there.  Generally  under 
the  name  Delusions  of  Grandeur,  the  team  competes  against  teams  of 
graduate  students  and  industry  professionals  worldwide  and  is  gen¬ 
erally  in  the  top  15  percent  of  competitors.10  The  training  range  cur¬ 
rently  consists  of  four  classrooms  with  raised  floors  and  computers, 
each  holding  approximately  23  students.  An  isolated  network  in¬ 
cludes  92  workstations,  with  commercial  Internet  access  to  sites  inac¬ 
cessible  on  the  Defense  Research  and  Engineering  Network  (DREN) 
and  Nonsecure  Internet  Protocol  Router  Network  (NIPRNet).  This 
configuration  allows  academy  cyber  teams  to  participate  in  competi¬ 
tions  that  run  on  ports  usually  blocked  by  USAFA  firewalls.  The 
“server  room”  that  supports  the  cyber  training  range  is  storage  space 
underneath  a  lecture  hall  with  upgraded  power  and  a  portable  air 
conditioner.  Equipment  refresh  and  software  licenses  are  estimated  at 
$150,000  per  year.  Key  software  used  on  the  cyber  range  includes 
Citrix  XenServer  (virtualization),  VMWare  Workstation  (virtualiza¬ 
tion),  FTK  (forensics),  and  IDA  Pro  (reverse  engineering).  IDA  Pro  is 
expensive  (the  USAFA  spent  $62,000  to  acquire  licenses  in  FY  2013), 
but  it  is  the  best  in  its  class  and  is  used  by  industry  professionals. 
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The  high  utilization  rate  of  the  range  has  led  to  a  planned  expan¬ 
sion  with  a  fifth  classroom,  contingent  on  FY  2015  funding.  Funding 
for  the  USAFA  range,  similar  to  that  for  Keesler  or  Hurlburt,  is  not  in 
the  USAF  POM.  The  money  to  put  in  raised  floors,  purchase  comput¬ 
ers,  and  so  forth,  originally  came  from  the  Defense  Information  As¬ 
surance  Program  (DIAP)  and  the  NRO,  enhanced  with  USAFA  fall¬ 
out  money.  Because  the  cyber  range  has  no  POM  and  it  is  no  longer 
DIAP  funded,  there  is  no  sustainment  plan.  Without  periodic  up¬ 
dates,  the  USAFA’s  cyber  range  is  not  running  the  most  current 
equipment.  One  faculty  member  interviewed  by  the  team  suspects 
that  this  shortfall  affects  Air  Force  retention  because  officers  cannot 
work  with  the  latest  tools  on  the  job.  A  long-term  sustainment  plan  is 
critical  since  without  the  cyber  range,  instructors  would  be  at  mis¬ 
sion  failure  due  to  the  limitations  of  standard  desktops.  For  these  rea¬ 
sons,  the  study  reiterates  the  recommendation  for  the  USAF  to  POM 
for  all  cyber  ranges  in  the  same  manner  it  does  for  operations,  main¬ 
tenance,  and  sustainment  in  the  air  and  space  domains. 

Reserve  Officer  Training  Corps 

Overall,  since  accession  targets  for  17-series  personnel  with  cyber 
degrees  are  going  to  rise  markedly,  USAFA  cyber  majors  will  be  inade¬ 
quate  to  sustain  the  educated  cyber  workforce  the  Air  Force  needs  to 
compete  with  adversaries.  Despite  the  positive  trends  above,  USAFA 
production  numbers  are  a  small  fraction  of  what  the  USAF  has  indi¬ 
cated  it  needs  in  the  near  future.  Thus,  ROTC  must  become  a  focal 
point  for  accessing  cyber-educated  officers. 

The  question  behind  the  issue  of  the  poor  number  of  STEM  gradu¬ 
ates  we  get  from  top  schools  is,  Where  do  we  aim  the  ROTC  scholarship 
dollars?  Many  recipients  of  ROTC  four-year  scholarships  will  not  ap¬ 
ply  to  expensive  private  schools  because  of  the  cost — scholarships  are 
typically  awarded  after  one  accepts  a  university’s  offer  of  admission. 
Prospective  students  from  poor  or  middle-class  backgrounds  will 
head  to  schools  they  can  afford  should  the  scholarship  not  come 
through.  Aiming  scholarship  dollars  toward  high-quality  state 
schools  (and  there  are  many)  will  work  not  only  in  cyber  but  also 
across  many  STEM  fields.  The  challenge  then  becomes  how  to  choose 
the  schools  that  will  best  meet  the  needs  of  the  Air  Force.  This  study 
finds  that  the  NSA’s  Cyber  Operations  Center  of  Academic  Excel¬ 
lence  (CAE-Cyber  Operations)  is  a  solid  basis  on  which  to  direct 
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ROTC  scholarship  dollars.  Schools  selected  into  the  CAE-Cyber 
Operations  program  must  demonstrate  that  their  curricula  are  inter¬ 
disciplinary  and  technically  centered  and  founded  on  CS,  CE,  and/or 
EE;  moreover,  they  must  provide  abundant  opportunities  for  practic¬ 
ing  skills  in  hands-on  labs  and  exercises.  This  program  is  intended  to 
support  the  president’s  initiative  to  “broaden  the  pool  of  skilled  work¬ 
ers  capable  of  supporting  a  cyber-secure  nation.”11 

At  present  the  USAF  does  a  poor  job  of  recruiting  cyber  officers 
from  top  schools  regardless  of  how  quality  is  measured.  Table  13  tal¬ 
lies  the  number  of  cyber  accessions  from  the  top  10  schools  on  both 
the  US  News  and  World  Report  list  and  the  NSA  accredited  schools 
list.  Of  nearly  200  cyber  accessions  per  year,  the  best  the  USAF  has 
done  in  recruiting  this  top-tier  talent  has  been  five,  or  approximately 
2  percent.  These  numbers  drive  this  study  to  recommend  that  applicable 
ROTC  detachments  be  permitted  to  recruit  students  into  the  USAF 
from  top  schools  using  three-and-a-half-year  AFROTC  scholarships 
to  improve  the  quality  of  education  of  USAF  cyber  accessions. 


Table  13.  USAF  cyber  accessions  from  the  top  10  schools 


1  2009 

2010 

2011 

2012 

2013  | 

Developed  from  data  provided  by  Office  of  the  Registrar,  Holm  Center,  Air  University,  March  2014. 


Amazingly,  the  USAF  recruits  large  numbers  of  cyber  operators 
from  schools  with  weak  computer  programs  through  ROTC.  Table  14 
shows  the  schools  that  produce  the  most  cyber  warriors  and  their  Ac¬ 
creditation  Board  for  Engineering  and  Technology  (ABET)  accredita¬ 
tion  status.  Seven  of  the  top  1 1  schools  have  programs  too  weak  to 
even  make  the  ranking  list  (below  115th)  in  the  discipline.  Nonethe¬ 
less,  the  USAF  accepts  its  inbound  officers  from  these  institutions.  Of 
the  schools  listed,  only  Penn  State  is  a  top-tier  program.  Many  of  the 
schools  on  the  CAE-Cyber  Operations  list  are  cost-effective  state 
schools  with  ROTC  programs.  Therefore,  targeting  AFROTC  schol¬ 
arship  dollars  to  these  schools  would  allow  the  Air  Force  to  gain  cy¬ 
ber  talent  educated  to  the  NSA  educational  standards. 

Recommendation:  Steady  ROTC  budgets  to  hedge  against  the  risk 
of  OTS  not  producing  adequate  quality/ quantity  of  17D  accessions 
when  the  economy  picks  up. 
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Table  14.  ROTC  cyber  degree  production  by  school  and  ABET  ac¬ 
creditation  status 


University 

Graduates 

ABET  Accredited 

Embry-Riddle  (FL  and  AZ) 

99 

Y 

Troy  University 

43 

N 

University  of  Notre  Dame 

37 

Y 

Clarkson  University 

34 

Y 

Illinois  Institute  of  Technology 

31 

Y 

Angelo  State  University 

31 

N 

Pennsylvania  State  University 

30 

Y 

Virginia  Military  Institute 

29 

Y 

The  Citadel 

27 

Y 

Iowa  State  University 

26 

Y 

Brigham  Young  University 

26 

Y 

Developed  from  Air  Force  Personnel  Center,  Personnel  Database,  Extracts  of  Officer 
Data,  1995-2014. 


Cyber  Advanced  Courses  in  Engineering: 
In-Sourcing  Educational  Force  Multipliers 

The  Air  Force  currently  has  two  Cyber  ACE  programs.  The  AFRL’s 
Advanced  Course  in  Engineering  Cyber  Security  Boot  Camp  (now 
called  the  ACE  Information  Assurance  Internship  Program)  in  Rome, 
New  York,  came  first.  The  other  is  AFIT’s  ROTC  Advanced  Cyber 
Education  program  at  Wright-Patterson  AFB,  Ohio.  Both  are  lauded 
by  the  Air  Force;  however,  pedagogically  they  are  not  the  same.  The 
similar  names  create  confusion,  a  fact  that  may  appear  to  the  reader 
as  the  description  of  the  two  programs  is  expanded  below.  Using  the 
same  acronym  for  two  distinct  programs  that  can  each  serve  to  ramp 
up  the  numbers  of  educated  Airmen  creates  confusion.  We  therefore 
strongly  recommend  changing  the  name  and  acronym  of  AFIT’s  pro¬ 
gram  to  help  differentiate  between  the  two  programs. 
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Advanced  Course  in  Engineering  Cyber  Security  Boot  Camp,  Air 
Force  Research  Laboratory,  Rome,  New  York 

According  to  AFIT’s  website,  the  AFRL  founded  the  ACE  Cyber 
Security  Boot  Camp  “in  response  to  President  George  W.  Bush’s  Na¬ 
tional  Strategy  to  Secure  Cyberspace.”  To  help  fulfill  the  president’s 
strategy,  the  program  was  created  in  2003  to  develop  top  ROTC  ca¬ 
dets  into  future  cybersecurity  leaders  by  designing  an  educational 
curriculum  to  train  the  cyber  workforce.  The  content  of  the  AFRL 
Cyber  ACE  program  originated  from  the  80-year-old  General  Elec¬ 
tric  (GE)  ACE  known  as  the  Edison  Engineering  Development  Pro¬ 
gram  model  to  educate  students.  The  ACE  Program  condensed  GE’s 
three-year  course  into  a  10-week  summer  course  designed  to  develop 
and  enhance  an  engineer’s  technical  problem-solving  skills.  The  ACE 
combines  advanced  academic  training,  hands-on  internships,  officer 
development,  and  weekly  eight-mile  runs  into  a  formidable  cyber¬ 
security  boot  camp.  The  ACE  was  designated  a  special- interest  item 
for  its  role  in  developing  officers  for  the  new  Air  Force  Cyberspace 
Command.  The  program  consists  of  advanced  engineering  course- 
work,  reports,  internships,  and  team  presentations  and  concludes 
with  a  cyber  defense  exercise. 

The  ACE  sought  students  who  completed  at  least  three  years  in  a 
computer-related  discipline  (EE,  CE,  CS,  or  information  studies)  and 
had  experience  in  programming,  networking,  and  operating  systems. 
In  2010  the  National  Defense  Authorization  Act  nationally  recognized 
the  ACE  as  a  program  “vital  to  ensuring  a  robust  information  tech¬ 
nology  workforce  that  is  capable  of  handling  cyber  threats  to  our  sys¬ 
tems”  and  requested  additional  funding  to  support  the  ACE  effort.12 
The  ACE  Cyber  Security  Boot  Camp  receives  no  Air  Force  funding  (as 
of  September  2014)  but  has  received  funding  from  the  Army  to  do  re¬ 
search  on  Army  issues.  In  addition  to  the  rigorous  cyber  engineering 
semester,  the  Crisis  Decision  Making  course  enhances  student  aware¬ 
ness  of  military  mission  analysis  and  planning  by  exposing  students  to 
case  studies  ranging  from  the  Civil  War,  Apollo  13,  and  the  Columbia 
and  Challenger  disasters  to  Blackhawk  Down.13 

The  Air  Force  Institute  of  Technology’s  Advanced  Course  in 
Engineering  Program 

In  201 1  the  AFRL’s  ROTC-focused  ACE  program  (i.e.,  POM  fund¬ 
ing)  was  transferred  to  AFIT  to  run  a  summer  cadet  program  for 
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AFROTC  students  (some  Army 
and  Navy  cadets  attended  as  well). 

Unfortunately,  ROTC  ACE  was  a 
victim  of  recent  budget  battles,  and 
the  program  was  not  offered  in 
2013  and  2014  although  it  should 
be  an  option  again  in  2015. 

Although  the  AFRL-ACE  pro¬ 
gram  develops  information  assur¬ 
ance  leadership  skills  for  precom¬ 
missioned  officers  for  the  DOD  (and 
now  the  British),  AFITs  ACE  pro¬ 
gram  concentrates  on  ROTC  sum¬ 
mer  internship  programs.  We  there¬ 
fore  recommend  that  AFIT  change 
the  name  of  its  program  to  avoid 
confusing  it  with  that  of  the  AFRL’s. 

A  timeline  outlining  the  history  of  the  programs  illustrates  the  issue: 

2003:  AFRL/RI  (Information  Directorate)  created  the  ACE  pro¬ 
gram  as  a  research  internship  program — largely  funded  from 
AFRL  sponsor  funds. 

2008:  AFRL/RI  obtained  funding  from  ROTC  and  made  the 
program  available  to  ROTC  cadets. 

2009:  ROTC  began  canceling  its  summer  internship  programs, 
but  ACE  continued  at  Rome  because  the  organization  had  other 
funding  sources. 

2010:  AFRL/CC,  AETC/CV,  and  AU/CC  agreed  to  move  the 
ROTC  cyber  program,  along  with  POM  funding,  to  AFIT.  Con¬ 
sequently,  AFIT  kept  the  ACE  acronym,  but  the  course  was  titled 
Advanced  Cyber  Education. 

2011-12:  AFIT  ran  a  version  of  the  ROTC  ACE  program. 

2013:  AFIT  cancels  the  ROTC  version  of  ACE  because  of  se¬ 
questration  and  budget  issues. 

2014:  AFIT  cancels  the  ROTC  version  of  ACE,  again  due  to 
budget  issues. 

2011-14:  AFRL  continued  running  its  ACE  cyber  research  in¬ 
ternship  program,  but  it  returned  to  its  pre-ROTC  focus  of  pro¬ 
viding  students  unique  cyber  engineering  problems  to  solve 


AFRL-ACE 

•  Solid  track  record  of  producing 
top  USAF  cyber  warriors. 

•  All  2013  CNODP  students  were 
ACE  graduates. 

•  Graduates  have  gone  on  to 
command,  receive  the  Von 
Karman  Award,  and  help  lead 
Twenty-Fourth  Air  Force  and 
USCYBERCOM. 

•  Flowever,  funding  is  erratic 
despite  program’s  small  cost. 

•  Recommend  that  the  USAF 
submit  annual  request  for  $1.2M 
via  POM  for  student  throughput. 
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while  giving  them  leadership  and  risk- management  lessons. 
However,  in  2013-14,  in  cooperation  with  AFIT,  it  expanded  its 
student  base  to  include  ROTC  cadets.  Some  of  the  AFIT  faculty 
go  to  Rome  and  teach/mentor  classes.14  Figure  30  illustrates  the 
overlap  of  the  two  programs. 


Figure  30.  Timeline  of  AFRL  ACE  and  AFIT  ACE  development 

Certainly,  both  Cyber  ACE  programs  are  force  multipliers  in  that 
they  emphasize  the  development  of  educated  cyber  warriors  who  can 
then  be  trained  in  the  art  of  cyber  warfare  for  national  security  objectives. 
Group  discussions  with  officers  at  UCT  resulted  in  a  consensus  that  ACE 
alumni  were  by  far  the  most  qualified  of  their  cohorts  in  terms  of  hands- 
on  keyboard  portions  of  the  course.  One  student  claimed  that  Cyber 
ACE  graduates  could  do  the  work  of  four  noncyber  ACE  graduates. 

Therefore,  we  recommend  that  the  Air  Force  review  how  it  can 
better  leverage  the  two  programs  to  help  meet  its  cyber  needs.  Other 
recommendations  in  this  area  include  fully  funding  the  AFIT  and 
AFRL  ACE  programs  in  the  POM  cycle  and  mandating  (AU  com¬ 
mander)  that  the  AFIT  ACE  program  be  renamed  to  avoid  confusion 
with  the  AFRL/RI  program. 

Officer  Training  School 

Since  1971  OTS  has  accessed  about  27  percent  of  the  Air  Force’s 
officers.  Except  for  an  uptick  between  2000  and  2003  in  the  ramp-up 
of  Operations  Enduring/Iraqi  Freedom,  OTS’s  percentage  of  the  en¬ 
tire  complement  of  new  officers  has  been  running  below  its  historical 
average  for  the  past  25  years  as  manning  end-strengths  have  been 
reduced.  However,  in  2013  OTS  accessions  again  made  up  27  percent 
of  newly  minted  officers.15  With  the  ROTC  budget  under  constant 
pressure,  this  recent  reliance  on  OTS’s  production  of  new  officers  is  a 
potential  problem.  This  study  determined  that  when  the  US  economy 
is  robust,  skilled  cyber  professionals — such  as  the  Air  Force’s  17Ds — 
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become  especially  hot  commodities  and  that  OTS’s  ability  to  recruit 
and  access  these  skills  drastically  decreases.  Because  of  the  Air  Force’s 
current  disinclination  to  direct  USAFA  cadets  to  certain  majors,  the 
academy  cannot  be  counted  upon  to  deliver  more  cyber-educated 
graduates.  With  both  OTS  and  USAFA  unable  to  reliably  populate 
the  Air  Force  officer  cyber  corps,  ROTC  must  bear  most  of  the  bur¬ 
den.  Consequently,  there  is  reason  to  be  concerned  that  continued 
hits  to  ROTC’s  budget  will  adversely  affect  the  Air  Force’s  ability  to 
produce  officers  to  fight  cyber  conflict.  The  available  empirical  evi¬ 
dence  on  the  effect  of  the  economy’s  overall  health  on  accessing  cy¬ 
ber-educated  officers  through  OTS  can  be  enlightening  when  one 
answers  the  two  questions  below. 

One  question  arises  during  attempts  to  link  the  country’s  eco¬ 
nomic  vitality  and  new  cyber  officer  production.  First,  how  is  eco¬ 
nomic  vitality  most  effectively  captured?  Since  the  emphasis  is  on  the 
job  market,  the  most  natural  metric  might  be  the  nation’s  official  un¬ 
employment  rate.  As  the  Congressional  Research  Service  has  pointed 
out,  “the  main  driver  of  the  unemployment  rate  is  the  pace  of  output 
growth,”  so  the  unemployment  rate  appears  to  be  a  good,  though  lag¬ 
ging,  proxy  for  overall  economic  well-being  as  measured  by  real  gross 
domestic  product  (GDP).16  Second,  how  can  high-quality  cyber  offi¬ 
cers  be  identified  at  the  beginning  of  their  careers?  Since  the  ability  to 
conduct  cyber  operations  at  the  highest  level  depends  on  technical 
expertise,  a  “cyber  degree”  (a  bachelor’s  degree  in  CS,  CE,  or  EE)  can 
serve  as  an  indicator  of  technical  merit. 

The  strength  of  the  relationship  between  cyber-degreed  officer  ac¬ 
cessions  and  the  unemployment  rate  can  be  evaluated  through  mea¬ 
suring  their  correlation.  Based  on  data  provided  by  the  Holm  Center 
and  the  Bureau  of  Labor  Statistics,  the  correlation  between  the  aver¬ 
age  yearly  national  official  unemployment  rate  and  the  percentage  of 
cyber-degreed  officers  accessed  from  OTS  was  0.772  for  the  period 
2005-12  (table  15). 17 

Table  15.  Average  yearly  unemployment  rate  and  percentage  of 
17D/33S  cyber  degree  holders  accessed  from  OTS  (2005-12) 


Developed  from  data  provided  by  the  Holm  Center  and  the  Bureau  of  Labor  Statistics. 
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Meanwhile,  the  total  number  of  cyber-degreed  officers  accessed  be¬ 
tween  these  years  had  a  correlation  of  -0.472  with  the  unemployment 
rate.18  This  finding  means  that  although  more  cyber  officers  have 
been  accessed  during  times  of  low  unemployment,  OTS’s  production 
has  declined  during  these  periods.  It  is  clear  that  the  Air  Force  should 
not  depend  too  heavily  on  OTS  for  highly  specialized  cyber  talent.19 
Although  this  trend  does  not  necessarily  mean  that  the  entire  ROTC 
budget  must  be  spared,  the  number  and  generosity  of  scholarships 
for  students  pursuing  cyber- related  degrees  should  be  preserved  and 
quite  possibly  increased.  When  one  considers  the  difference  in  the 
quality  of  institutions  granting  cyber-related  degrees  to  ROTC  cadets 
versus  OTS  graduates  (see  the  previous  discussion  in  this  section), 
this  argument  becomes  even  more  powerful. 

The  correlations  show  that  OTS  production  of  cyber  graduates 
falls  during  robust  economic  times.  The  data  suggests  that  in  times  of 
economic  growth,  OTS  is  not  a  reliable  producer  of  cyber  warriors. 
In  addition  to  its  problematic  nature  of  recruiting  in  a  prospering 
economy,  OTS’s  accessions  come  from  a  pool  of  educational  institu¬ 
tions  inferior  to  those  of  ROTC  graduates.20  This  finding  is  based  on 
the  fact  that  82  percent  of  ROTC  accessions  are  from  schools  with 
ABET  accreditation  compared  to  only  26  percent  of  OTS  accessions 
(fig.  31).  ROTC  thus  provides  not  only  a  more  reliable  source  for  fill¬ 
ing  the  cyber-officer  void  but  also  better  quality. 
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Figure  31.  ABET-accredited  program  graduates  from  top-producing 
colleges.  (Developed  from  Air  Force  Personnel  Center,  Personnel  Data¬ 
base,  Extracts  of  Officer  Data,  1995-2014.) 
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Therefore,  this  study  recommends  that  the  Air  Force  fully  fund  the 
ROTC  Scholarship  Program  to  ensure  a  reliable,  quality  source  of  cy¬ 
ber  accessions.  Moreover,  the  Air  Force  should  use  these  scholarship 
dollars  to  target  recruiting  at  institutions  superior  in  quality  to  those 
from  which  we  have  historically  drawn  our  new  lieutenants. 

Adjustments  have  been  made  in  table  16  to  equate  average  length 
of  service.  The  1B4  field  was  identified  as  a  secondary  AFSC  because 
of  incomplete  data  for  the  population.  On  the  enlisted  side,  we  see  no 
evidence  of  adverse  selection  in  education  for  personnel  cross-training 
into  1B4  (at  least  compared  to  lNXs  and  3DXs). 


Table  16.  Percentage  of  Airmen  by  career  field  and  educational  level 


Career  field 

Associate's 

degree 

Bachelor's 

degree 

Master's 

degree 

1B4 

41 .2% 

8.48% 

0.6% 

1  NX 

21.1% 

7.1% 

0.4% 

3DX 

26.2% 

7.0% 

0.8% 

Developed  from  analysis  of  AFPC  enlisted  database,  1998-2014. 


Air  University  and  Education  at  the  Operational  Level 

According  to  USAF  doctrine,  operational-level  education  “assumes  a 
larger  role  in  an  Airmans  development”  and  “is  intended  to  enhance 
professional  competence  through  intermediate  developmental  educa¬ 
tion.”  Education  at  this  level  is  also  “focused  on  furthering  expertise 
across  related  specialties  and  increasing  leadership  responsibilities”  and 
“continues  to  build  tactical  skills  and  . . .  professional  competence.”  For 
example,  “majors  will  be  expected  to  perform  duties  as  flight  command¬ 
ers  or  operations  officers  to  gain  skills  at  a  higher  level  in  the  squadron 
and  complete  intermediate  developmental  education  or  a  selected  grad¬ 
uate-level  degree  program  to  further  their  educational  needs  as  matur¬ 
ing  professionals.”  The  crux  is  that  development  in  elite  cyber  warriors 
will  include  a  combination  of  both  PME  and  developmental  education. 
In  parallel  with  their  officer  counterparts,  NCOs  attend  “relevant  spe¬ 
cialty  schools  and  pursue  professional  continuing  education  [PCE]  pro¬ 
grams.  Civilian  personnel  at  this  level  fill  positions  with  greater  organi¬ 
zational  and  technical  responsibilities.  As  with  their  military 
counterparts,  they  may  be  selected  to  attend  an  advanced  academic 
degree  program  ...  or  [for]  education  with  industry.”21 
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AFIT  Graduate  Cyber  Degree  Programs 

AFIT,  which  falls  under  AU,  has  the  Graduate  School  of  Engineer¬ 
ing  and  Management  (EN).  The  grad  school  includes  departments 
typically  found  at  any  university  (e.g.,  Mathematics,  Physics,  and 
Electrical  and  Computer  Engineering  [offering  the  Cyber  Operations 
master’s  degree]).  Students  selected  are  primarily  Air  Force  person¬ 
nel  sent  as  part  of  the  Air  Force  Education  Requirements  Board 
(AFERB)  process  and  attend  for  18  months  to  earn  a  master’s  degree 
or  36  months  for  a  PhD.  In  2013  the  Air  Force  sent  a  total  of  three 
cyber  17Ds  to  master’s  programs,  and  in  2014  it  sent  eight.  These 
numbers  are  less  than  1  percent  of  our  17-series  cyber  force. 

In  2007  AFIT  instituted  the  Cyber  Warfare  Intermediate  Develop¬ 
mental  Education  (IDE)  Master’s  Degree  Program  for  developing 
midgrade  officers.  Graduates  were  to  be  the  USAF’s  senior  cyber  lead¬ 
ers  within  5  to  10  years  of  graduation.  In  2012  the  Air  Force  decided  to 
stop  sending  IDE  students  to  AFIT — including  all  AFIT  IDE  programs, 
not  just  Cyber  Warfare — making  the  2012-13  academic  year  the  final 
one  that  hosted  a  Cyber  Warfare  class.  During  the  six  years  of  the  pro¬ 
gram,  AFIT  produced  45  graduates.22  Existing  capacity  and  resources 
(instructors,  classroom  space,  etc.)  could  have  been  used  to  educate  30 
additional  cyber  warfare  IDE  students  without  additional  faculty  or 
facilities.  However,  the  program  was  discontinued.  Nonetheless,  the 
capacity  to  restart  the  program  with  30  IDE  students  remains. 

In  addition  to  the  now  defunct  Cyber  Warfare  IDE  program,  AFIT 
has  an  18-month  cyber  operations  master’s  program.  Issues  with  the 
AFERB  process  present  problems  for  getting  17-series  operators  into 
the  program.  If  units  fail  to  code  their  billets  as  requiring  advanced 
degrees,  the  Air  Force  doesn’t  send  people  to  get  them.  This  deficiency 
affects  not  only  AFIT  but  also  all  graduate  school  opportunities  such 
as  universities  and  the  Naval  Postgraduate  School.  The  research  team 
found  that  units  are  not  coding  their  billets  because  when  they  were 
coded  for  AADs,  the  billets  went  unfilled  since  no  graduates  were 
available.  Two  or  three  years  ago,  during  the  AFERB  meetings  to  de¬ 
cide  how  many  people  were  going  to  go  to  graduate  school,  cyber 
AAD  requirements  had  not  been  identified,  billets  were  not  coded, 
and  then  the  functional  managers  were  not  able  to  advocate  effectively 
for  their  needs.  The  good  news  is  that  two  years  ago,  SAF/A6,  Maj  Gen 
Earl  Matthews,  successfully  advocated  for  35  potential  students;  they 
began  their  master’s  programs  at  AFIT  in  the  fall  of  2015. 
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Recommendations:  To  address  the  shortage  of  AAD  billets  in  cy¬ 
ber,  this  study  recommends  that  the  USAF  engage  in  a  sequence  of 
actions  to  undo  the  destructive  effects  of  previous  AFPC  actions. 

•  First,  the  Air  Force  should  mandate  that  cyber  units  review  and 
code  their  billets  for  AADs.  Newly  formed  units  that  are  cyber¬ 
protection  organizations — such  as  the  624th  Operations  Center, 
39  IOS,  and  others — must  implement  this  requirement  as  part  of 
their  initial  unit  manning  document. 

•  Second,  AFPC  should  examine  replacing  the  cumbersome  (and 
always-behind-the-times)  AAD-billet-driven  system  with  an 
inventory-based  model.  Instead  of  redesignating  billets  for 
AADs  every  year,  the  center  should  assure  that  “X  percent  of 
cyber  officers”  have  advanced  degrees  (MS  and  PhD)  in  cyber. 

•  Third,  the  research  team  believes  that  the  most  economical  path 
to  fill  the  void  of  cyber  operation  AADs  is  to  send  some  selects 
through  the  AFIT  cyber  operations  masters  degree  course, 
which  has  excess  capacity. 

•  Fourth,  AFPC  must  assign  personnel  in  a  way  that  does  not  re¬ 
create  the  original  problem.  When  personnel  with  AADs  are  not 
available,  AFPC  must  still  fill  these  billets  with  the  best  available 
talent. 

•  Fifth,  a  full  reevaluation  of  the  AAD  slots  and  requirements 
should  be  embedded  within  the  POM  process  to  effectively  up¬ 
date  requirements  over  time. 

•  Lastly,  because  a  year  away  from  cyber  ops  results  in  the  need  for 
regaining  currency,  the  USAF  should  evaluate  the  merits  of  creat¬ 
ing  a  two-year  PME  path  consisting  of  Air  Command  and  Staff 
College  (ACSC)  followed  by  AFIT’s  cyber  operations  MS,  com¬ 
puter  science  MS  and  PhD,  or  computer  engineering  MS  and 
PhD,  paralleling  the  current  path  of  ACSC  followed  by  SAASS. 

AFIT  Professional  Continuing  Education  Programs 

AFIT  developed  and  implemented  the  Cyber  200  and  300  PCE 
curricula  in  less  than  a  year  after  being  tasked  by  AETC/CC.  Over 
600  officers  will  have  completed  these  courses  in  the  first  year  of  opera¬ 
tion.  Cyber  200  and  300  are  required  for  17-series  personnel  to  obtain 
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their  professional  ratings  and  advance  within  the  Air  Force.  They  are 
currently  in  review  to  become  joint  certified. 

Cyber  200  and  300  are  part  of  the  USAF  cyber  force  development 
process  for  17XX  officers.  However,  students  from  other  AFSCs — 
including  intel,  acquisition,  and  R&D — as  well  as  from  the  civilian, 
Army,  and  joint  world  are  also  enrolled.  Cyber  200,  a  three- week 
course  for  officers  with  about  six  to  eight  years  of  commission  time, 
runs  like  a  cyber  Squadron  Officer  School.  Cyber  300  is  designed  pri¬ 
marily  for  majors  and  lieutenant  colonels.  The  focus  shifts  from  tacti¬ 
cal  operational-level  discussions  toward  policy,  strategy,  and  the  big 
picture.  The  two  classes  are  normally  taught  in  conjunction,  and  their 
students  graduate  at  the  same  time.  In  a  capstone  course,  students 
from  both  classes  work  together  as  part  of  a  larger  campaign  plan. 
Another  class  that  has  been  running  is  C-EDGE,  a  one-day  class  for 
colonels  and  above  that  typically  has  six  to  eight  students.  It  addresses 
high-level  awareness  of  the  nature  of  cyber.  AFIT/EN  has  been  work¬ 
ing  with  the  AFIT  Civil  Engineer  School  to  help  develop  short  courses 
on  cyber  vulnerabilities  and  dependencies.  It  is  also  working  with 
AFIT/LS  (Logistics  Systems),  the  Air  Force  Life  Cycle  Management 
Center,  and  Headquarters  Air  Force  Materiel  Command  on  short 
courses  for  cyber-dependent  weapon  systems. 

Air  University:  Education  at  the  Operational  and 
Strategic  Levels  of  Cyber  Conflict 

The  teaching  and  research  at  AFIT  are  critical  to  the  Air  Force; 
however,  it  is  not  enough  to  have  people  who  are  technically  proficient. 
The  Air  Force  also  requires  individuals  who  can  apply  technology 
within  a  joint  operational  planning  construct  (e.g.,  JP  5-0,  Joint  Opera¬ 
tion  Planning,  1 1  August  2011)  and  use  critical  thinking  in  determin¬ 
ing  the  impact  of  cyber  on  their  mission.  Every  Air  Force  mission 
requires  networked  connectivity  to  some  degree  or  another.23  Addi¬ 
tionally,  every  weapon  system  depends  on  data  and  signals  both  in¬ 
ternally  to  accomplish  its  own  mission  and  externally  to  connect  and 
work  with  the  rest  of  the  forces.  How  do  we  establish  a  secure  soft¬ 
ware/hardware  environment  if  industry  builds  our  platforms? 

To  assure  our  missions,  the  Air  Force  needs  a  cadre  of  mission  plan¬ 
ners  who  understand  the  effect  of  cyber  dependencies.  This  cadre  must 
also  articulate  mission  requirements  to  the  engineering  community 
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(62Es)  and  other  acquisition  personnel  who  recognize  a  platform’s 
reliance  on  cyber  and  know  how  to  design  security  into  key  compo¬ 
nents  of  the  cyber  platform.  Conceptualizing  and  articulating  the 
specifications  to  be  built  into  the  hardware/software  will  increase  the 
cost  of  success  to  the  adversary  but  require  62Es  and  system  engi¬ 
neers  to  document  appropriate  operational  requirements  in  con¬ 
tracts.  This  practice  can  also  be  extended  into  mission  planning  dur¬ 
ing  which  teams  of  nontechnical  mission  planners  relay  to  the 
technical  cyber  wizards  the  mission  requirements  and  objectives. 

The  integration  of  cyberspace  and  military  operations,  however,  is 
still  a  nascent  capability.  As  a  result,  concepts  of  operations  are  still  in 
their  embryonic  stage.  There  is  no  focal  point  that  serves  to  bring 
together  technical  cyber  operators  and  nontechnical  mission  plan¬ 
ners,  analysts,  and  operators  for  resolving  issues  related  to  integrating 
cyber  into  military  operations.  It  is  our  determination  that  AU  has  an 
important  role  to  play  in  allowing  select  students  to  blend  operations 
and  theory  in  the  classroom  and  experiment  with  new  ideas.24  AU  is 
ideally  suited  to  fill  this  unmet  need  because  it  can  combine  the  tech¬ 
nical  capabilities  of  AFIT  with  the  political  science  aspects  of  the 
schools  at  Maxwell  AFB.  The  area  of  focus  at  Maxwell  should  not  be 
tactical  since  other  schools  (such  as  the  USAF  Weapons  School  at 
Nellis)  address  this  area.  AU’s  emphasis  should  be  on  operational- 
level  issues  and  topics  applicable  to  the  broad  Air  Force  audience.  As 
of  this  writing,  AU  is  standing  up  a  Cyber  and  Electronic  Warfare 
(EW)  Research  Task  Force  to  help  bridge  the  gap  between  operations 
and  theory.  The  research  team  recommends  that  after  one  year  of  ini¬ 
tial  operating  capability,  the  cyber/EW  task  force  be  evaluated  for 
consideration  to  serve  as  the  foundation  for  a  new  Consortium  for 
Advanced  Cyber  Thinking  and  Strategy  (C-ACTS)  at  AU.  This  center 
will  provide  thoughtful  leadership  to  promote  new  ideas  and  concepts 
and  to  perform  Air  Force  core  missions  (air  and  space  superiority,  ISR, 
rapid  global  mobility,  global  strike,  command  and  control)  in, 
through,  and  by  means  of  cyberspace.  As  the  Cyber/EW  Task  Force 
takes  shape,  the  following  existing  cyber  education  initiatives  at  AU 
have  contributed  to  cyber  education  at  Maxwell  AFB. 

Air  War  College  Cyber  Horizons  Research  Elective 

The  Cyber  Horizons  Group  Research  two-term  elective  is  taught 
by  SMEs  from  the  Air  Force  Research  Institute,  Air  War  College 
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(AWC),  and  the  LeMay  Center  Directorate  of  Intelligence.  It  provides 
focused  study  and  development  of  research  projects  that  meet  semi¬ 
nar  requirements,  supports  student  professional  studies  papers  for 
AWC,  and  assists  larger  USAF  requirements.  The  course  is  designed 
to  make  students,  regardless  of  background,  effective  and  credible 
within  the  cyber  warfare  community.  Its  purpose  is  to  explore  the 
organized  use  of  cyber  power  for  the  state,  with  particular  attention 
paid  to  the  US  government  cyber  community;  allies,  major  partners, 
and  global  aspects  in  the  conduct  of  cyber  warfare;  cyber  vulnerabili¬ 
ties  and  threats;  and  operations,  planning,  and  analysis  of  desired  ef¬ 
fects  in  the  domain.  The  course  objective  is  to  cultivate  students’  abil¬ 
ity  to  predict,  deter,  and  prevent  adversary  actions  and  reactions  in 
the  cyber  domain.  Students  leave  this  course  with  a  clearer  under¬ 
standing  of  the  larger  context  of  cyber  conflict;  significant  knowledge 
of  vulnerabilities,  threats,  operations,  mission  planning,  and  analysis; 
an  orientation  to  major  policies  and  organizations  in  the  cyber  do¬ 
main;  increased  literacy  in  strategic,  policy,  doctrinal,  and  technical 
aspects  of  cyber  warfare;  and  an  understanding  of  the  adversary 
mind-set.  Finally,  through  preparing  their  professional  studies  papers, 
students  conduct  research  to  address  broader  Air  Force  needs. 

LeMay  Center 

Cyberspace  Operations  Executive  Course.  The  COEC  is  a  joint 
two-day  USAF-owned  course  led  by  an  experienced  senior  mentor 
and  designed  to  provide  senior  USAF  leadership  with  an  understand¬ 
ing  of  network  vulnerabilities,  threat  activity,  and  ongoing  efforts  to 
protect  and  operate  within  the  cyberspace  domain.  Its  objective  is  to 
broaden  senior  leaders’  knowledge  of  cyberspace  issues  from  a  DOT- 
MLPF  (doctrine,  organization,  training,  materiel,  leadership  and  edu¬ 
cation,  personnel,  and  facilities)  perspective  so  they  can  effectively 
influence  national  and  strategic  cyber  policy.  The  long-term  plan  is 
for  the  COEC  to  transition  to  a  joint  course. 

The  COEC  serves  as  the  DOD’s  senior/intermediate  general  flag 
officer-level  PCE  course  and  is  offered  semiannually  at  two  different 
levels.  The  first  is  the  Senior  COEC  for  three-  and  four-star  flag  officers 
and  Tier  3  Senior  Executive  Service  members.  The  second  is  Junior 
COEC  for  one-  and  two-star  officers  and  civilian  equivalents.  Instruc¬ 
tion  for  the  course  comes  from  national-level  experts  and  leaders  in 
industry,  academia,  and  the  military  who  offer  senior  perspectives  on 
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cyberspace  issues  and  address  topics  such  as  definition  of  the  cyber¬ 
space  problem  set,  information  assurance,  legal  implications,  cyber¬ 
space  integration,  foreign  policy,  and  national  options.25 

Senior  Joint  Information  Operations  Applications  Course.  The 
purpose  of  the  SJIOAC  is  to  prepare  “selected  general/flag  officers 
and  senior  executive  civilians  to  develop  information  operations  (IO) 
into  a  warfighting  core  military  competency  that  will  enable  combat¬ 
ant  commanders  to  target  adversary  decision-making  while  protect¬ 
ing  our  own.”  SJIOAC’s  primary  methodology  is  a  “combination  of 
informal  lecture,  interactive  seminar  discussion,  demonstration,  and 
case  studies.”  Speakers  include  “senior  national- level  civilian  and  mili¬ 
tary  leaders,  representing  national  agencies  and  organizations,  and 
combatant  commands.”26 

Information  Operations  Fundamentals  Application  Course. 

The  IOFAC  educates  intermediate  leaders  in  the  fundamental  prin¬ 
ciples  of  IO  in  accordance  with  the  LeMay  Center’s  Annex  3-13,  Infor¬ 
mation  Operations.  The  course  objective  is  “to  provide  students  with 
a  broad  understanding  of  [IO]  doctrine  and  insight  into  how  [IO]  is 
applied  across  the  full  spectrum  of  conflict  from  peace  to  war.”  It  is 
taught  through  lectures,  seminars,  practical  exercises,  readings,  and 
case  studies.27 

School  of  Advanced  Air  and  Space  Studies.  SAASS  currently  re¬ 
quires  students  to  take  the  667  Information,  Cyberspace,  and  Cyber 
Power  course,  which  introduces  basic  cyber  systems  concepts  to  non¬ 
technical  students.  The  20-day  course  examines  “the  fundamentals, 
development  and  evolution  of  information,  cyber  power,  and  intelli¬ 
gence.  [It]  intends  to  foster  critical  thinking  about  underlying  concepts, 
strategies  and  issues  that  optimize  information,  cyber  power,  and  intel¬ 
ligence  as  instruments  of  national  power,  and  to  advance  the  develop¬ 
ment  of  each  students  personal  theory  of  air,  space  and  cyber  power.”28 

One  great  hindrance  to  integrating  “more  cyber”  into  the  AU  cur¬ 
riculum  is  the  Chairman  of  the  Joint  Chiefs  of  Staff  Instruction  (CJCSI) 
1800.01E,  Officer  Professional  Military  Education  Policy  [ OPMEP ],  29 
May  2015.  For  ACSC  and  AWC,  this  instruction  directs  what  must  be 
taught.  The  research  team  believes  that  cyber  is  not  included  at  the 
level  that  may  be  most  appropriate  to  address  the  reality  of  this  rapidly 
evolving  domain.  Currently,  it  is  available  only  as  an  elective.  If  cyber 
is  to  be  accepted  and  recognized  for  the  operational  domain  it  is,  then 
the  OPMEP  must  be  updated  and  expanded  for  cyber. 
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In  December  2005  the  Air  Force  changed  its  mission  statement  to 
include  cyberspace  as  an  operational  domain.  Lt  Gen  Stephen  Lorenz, 
the  AU/CC,  recognized  in  December  2006  that  the  PME  school  faculty 
lacked  cyber  expertise  and  direction  on  the  cyber  content  to  include  at 
each  level  of  PME.29  At  General  Lorenzs  direction,  AFIT  conducted  a 
study  of  existing  officer  PME  programs  and  developed  a  cyber-require¬ 
ments  document  loosely  modeled  after  the  OPMEP.  The  idea  was  to 
produce  something  that  each  school  could  use  to  develop  its  own  cyber 
curriculum  that  would  best  fit  into  its  level  of  PME  but  not  dictate 
course  material.30 

This  approach  was  consistent  with  how  the  OPMEP  works;  in  addi¬ 
tion  to  service  headquarters-level  questions,  CSAF  guidance,  CJCS/ 
CSAF  SEIs,  and  AETC  guidance,  the  OPMEP  simply  states  require¬ 
ments  for  topics  to  be  covered  and  leaves  it  up  to  the  service  schools  to 
figure  out  how  to  implement  the  guidance  within  their  own  programs. 
The  research  team  shared  the  final  report  for  this  study  with  all  of  the 
schools  and  briefed  it  to  the  AU/CC  and  his  staff.31  Although  somewhat 
dated  (2007),  it  remains  useful  since  struggles  with  similar  issues  con¬ 
tinue.  For  example,  questions  that  arose  at  the  time  included  how  and 
by  whom  the  content  was  developed  and  who  sets  the  priorities  for  the 
content  that  comes  out  of  the  program  to  make  room  for  cyber. 

If  the  OPMEP  drives  the  joint  PME  curriculum,  then  it  appears  that 
AU  could  influence  PME  programs  by  working  proactively  with  the 
Military  Education  Coordination  Council  (MECC),  the  body  that 
works  the  OPMEP  requirements.  In  2009  the  MECC  wanted  to  add 
“space  as  a  contested  environment”  for  inclusion  into  joint  PME.  The 
MECC  tasked  the  National  Security  Space  Institute  (NSSI)  to  develop 
the  coursework,  which  included  five  hours  of  instruction.32  This  coor¬ 
dination  among  PME/PCE  institutions  and  MAJCOMs  highlights  a 
possible  venue  for  cross-pollination  between  cyber  operations  and 
current  joint  PME.  The  potential  thus  exists  for  nesting  the  education 
under  existing  objectives  rather  than  trying  to  add  new  objectives 
within  the  OPMEP  (e.g.,  objectives  that  discuss  how  joint  forces  fight). 

Toward  an  Air  Force  Cyber  Operational  History 

Operational  theory  as  it  applies  to  cyber  and  EW  “beyond  poles 
and  wires”  is  lagging  technology,  thus  causing  a  significant  problem 
for  the  Air  Force  and  placing  missions  within  the  five  core  functions 
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at  risk  of  failure  due  to  cyber  disruptions.33  We  currently  lack  a  his¬ 
torical  context  gleaned  from  lessons  learned  in  cyber  operations  past. 
The  generation  and  publication  of  a  sufficiently  rigorous  and  robust 
set  of  operational  theory  informed  by  cyber  history  can  become  the 
foundation  on  which  to  guide  problem  formulation.  It  can  enable 
Airmen  to  leverage  the  opportunities  of  new,  emerging  computing 
and  networking  technologies  while  assuring  missions  against  the  vul¬ 
nerabilities  of  adversary  usage.  However,  the  first  step  is  for  the  USAF 
to  recognize  and  be  proud  of  its  cyber  heritage  and  instill  a  sense  of 
cyber- mindedness  in  its  Airmen. 

The  USAF  has  overinvested  in  capabilities  and  doctrine  not  guided 
by  technological,  operational,  and  strategic  realities  of  cyber  conflict 
as  a  result  of  lacking  historical  analysis  of  the  domain.  An  initial  ef¬ 
fort  to  document  these  shortcomings  is  found  in  A  Fierce  Domain,  an 
Air  Force-centered  cyber  history  book.34  Without  more  efforts  to 
codify  unit  histories  and  craft  a  formal  Air  Force  cyber  historical  ac¬ 
count  that  can  then  be  integrated  into  its  curriculum,  the  service  is 
neglecting  to  integrate  lessons  learned  from  over  30  years  of  opera¬ 
tional  experience  in  the  domain.  The  difficulty  in  assimilating  cyber 
history  into  PME  education  is  that  the  content  of  PME  courses  is 
specified  by  CJCSI  1800-01E,  as  described  above.  This  instruction, 
under  the  purview  of  J7  (Joint  Force  Development),  has  a  lengthy 
modification  process,  and  the  presidents  of  AU,  Army  War  College, 
Navy  War  College,  and  National  Defense  University  must  agree  to 
make  any  changes  before  starting  this  process  with  the  MECC. 

Simply  finding  that  cyber  history  is  not  taught  in  PME  is  not 
enough;  a  systemic  effort  to  collect  and  write  the  history  of  Air  Force 
cyber  should  be  conducted  internally.  Thus,  the  following  actions  are 
recommended: 

•  Commission  the  US  Air  Force  Historical  Research  Agency  to 
collect  official  cyber  unit  histories  and  oral  histories  of  the  pio¬ 
neers  of  the  Air  Force  cyber  mission  and  to  work  closely  with 
doctrinal  authors  to  ensure  continuity  in  cyber. 

•  Commission  AU  to  use  this  material  as  the  basis  of  a  major  study 
with  appropriate  lessons. 

•  Integrate  cyber  heritage  and  lessons  into  all  PME. 
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Following  these  steps  will  ensure  that  cyber  history  begins  to  be  taught 
and  that  we  do  not  keep  repeating  the  mistakes  of  lessons  unlearned. 

DOD  Conference  Policies’  Negative  Impact  on  Faculty  and 
Curriculum  Relevancy 

Existing  Air  Force  conference  policies  negatively  affect  faculty 
currency  and  credibility  in  a  dynamic  domain  that  relies  on  networks 
of  personal  relationships  to  facilitate  information  flow  and  foster  pro¬ 
fessional  development.  Indeed,  Annex  1-1,  Force  Development,  that 
“educators  should  survey  training  methods  outside  of  organizational 
bounds  (other  Services,  government,  and  industry)  to  stay  abreast  of 
new  training  and  education  insights  and  best  practices  and  adapt 
these  methods  to  the  programs  for  training  and  educating  the  force.”35 
The  current  DOD  and  USAF  restrictions  for  non-DOD  conferences 
have  rendered  it  virtually  impossible  for  the  USAF  cyber  force  to  op¬ 
erate  within  its  doctrine  and  remain  current  with  and  relevant  to  the 
changes  in  cyber. 

To  be  a  leader  in  the  emerging  cyber  profession  requires  not  only 
immersion  in  technology  but  also  participation  in  the  forums  of  the 
communities  of  practice  and  professional  societies.36  If  one  is  in  the 
IT  business,  relationships  with  other  IT  leaders  and  professionals  are 
critical.  The  field  is  complex,  and  faculty  and  researchers  must  be  able 
to  keep  pace  with  changes  to  integrate  the  state  of  the  art  as  it  is  being 
developed  in  the  private  sector  into  Air  Force  operations  and  curri¬ 
cula.  Anecdotally,  this  study  found  that  several  senior  Air  Force  lead¬ 
ers  viewed  their  working  relationships  with  Silicon  Valley  venture 
capitalists  and  industry  leaders  as  crucial  to  their  ability  to  succeed  in 
the  field.  Thus,  to  grow  these  networks  through  interactions  at  work¬ 
shops  and  conferences,  it  is  critical  that  the  Air  Force  amend  its  rules 
for  faculty  attending  or  presenting  at  such  gatherings. 

Training  Cyber  Forces 

Although  cyber  force  training  was  discussed  in  chapter  5,  “Force 
Development,”  the  focus  here  is  on  initial  training  for  a  handful  of  spe¬ 
cialties.  These  include  officers  in  the  17S-series  (cyber  warfare  opera¬ 
tions)  and  14N-series  (intelligence)  cyber  specialty  codes  as  well  as 
enlisted  personnel  in  the  1B4X1  AFSC  (cyber  warfare  operations — 
retrained  from  the  3DXX  [cyberspace  support  specialty])  and,  to  a 
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lesser  extent,  1N4X1A — the  fusion  analyst  /  digital  network  analyst 
AFSC.37  A  research  team  interviewed  leadership,  staff,  and  students 
about  cyber  graduates  at  Keesler  and  Goodfellow  AFBs  and  Hurlburt 
Field.  Cyber  training  is  a  long  process  for  17S  and  1B4X1  students. 
For  those  ultimately  assigned  to  the  national  mission  teams,  the  du¬ 
ration  could  be  over  24  months.  A  comparison  of  the  money  and 
time  allocated  for  training  with  the  enlistment  commitment  or  ADSC 
reveals  that  the  return  on  investment  can  be  quite  low.38 

Officer  and  enlisted  students  are  exposed  to  a  variety  of  theories 
and  scenarios  related  to  confronting  threats  to  our  national  systems. 
Officers  receive  the  broad  overview  of  the  systems  and  defenses,  and 
enlisted  students  learn  to  operate  the  checklists  to  support  and  defend 
the  networks.  The  initial  course  is  roughly  90  to  95  percent  theory  and 
5  to  10  percent  hands-on  experience,  thus  differing  from  some  industry 
practices  such  as  Googles,  which  advocates  learning  by  doing  rather 
than  by  studying.39  It  allows  people  to  learn  from  their  mistakes;  emu¬ 
lating  the  cyber  giant’s  hands-on  approach  is  desirable.  In  follow-on 
courses  for  cyber  Airmen,  the  hands-on  time  increases  to  40  percent  or 
more — more  interactive  and  less  book  learning. 

The  Air  Force’s  investment  in  producing  these  cyber  Airmen  is  sig¬ 
nificant.  To  avoid  squandering  it,  the  service  needs  to  examine  its 
commitment  and  assignment  processes  for  these  officers  and  Air¬ 
men.  Cyber  Airmen  should  rotate  less  and  have  at  least  two  consecu¬ 
tive  cyber  tours — a  change  that  could  alleviate  additional  training 
requirements  while  allowing  the  development  of  deeper  cyber  skills. 
Other  cyber  specialty  training  should  also  be  more  thoroughly  re¬ 
viewed,  including  that  for  positions  such  as  civilians  in  the  GS-2210 
IT  management  series  who  acquire,  manage,  and  maintain  cyber  sys¬ 
tems.  They  should  be  key  players  in  the  procurement  of  cyber  re¬ 
sources  for  the  Air  Force.  The  team  discovered  some  additional  train¬ 
ing  issues  that  bear  mentioning. 

Training  Issues 

Credit  for  Education  and  Experience 

This  study  proposes  evaluation  of  a  test  similar  to  the  CLEP  (used 
for  student  placement)  for  use  in  UCT  to  find  individuals  with  the 
requisite  skills.  Students  with  either  an  educational  foundation  or 
previous  work  experience — commercial  or  military — could  test  out 
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of  certain  portions  of  the  curriculum.  This  test  could  also  be  applied 
to  other  cyber  courses  administered  by  the  Air  Force  or  the  joint 
community  One  professor  mentioned  that  it  was  not  a  smart  training 
model  to  repeat  training  for  graduates  in  CS,  CE,  and  EE  at  UCT  just 
because  other  individuals  are  less  familiar  with  cyberspace.40 

This  concept  could  also  be  used  to  grant  mission  equivalency 
based  on  previous  experiences  of  students  or  to  accommodate  those 
returning  to  the  cyber  field  (e.g.,  an  AFSC  17D  communications  of¬ 
ficer).  Although  this  situation  may  apply  to  only  a  small  number  of 
students,  they  could  be  fast-tracked  or  given  other  experiential  work, 
saving  resources  for  the  Air  Force.  Other  alternative  on-ramps  should 
be  available  for  individuals  to  enter  the  cyber  field  based  on  their 
educational  or  experiential  backgrounds. 

Facilities  and  Equipment 

The  USAF  cyber  force  receives  its  training  at  underfunded  and  un¬ 
derdeveloped  training  locations.  Initial  training  at  Keesler — a  cobbled- 
together,  understaffed  operation — nonetheless  provides  solid  entry- 
level  training  to  future  cyber  forces.  Additional  funding  in  20 14  allowed 
expanding  existing  and  building  new  sensitive  compartmented  infor¬ 
mation  facilities  (SCIF)  to  handle  an  expected  increased  training  load. 
The  cyber  range  also  underwent  a  $1.5  million  upgrade.41 

Despite  increased  funding,  the  Keesler  team  has  no  backup  for  its 
cyber  range  equipment.  This  range — built  in-house  with  castoff  and 
obsolete  equipment — provides  suboptimum  and  incomplete  train¬ 
ing.  When  a  system  technology  must  be  refreshed,  the  school  has  to 
curtail  training  for  that  time.  Training  pauses  are  not  feasible  because 
of  student  production  scheduling.  A  joint  range  could  be  used  to  sat¬ 
isfy  training  requirements,  but  the  faculty  believes  it  needs  its  own 
operating  environment  to  better  prepare  students. 

Although  Air  Force  flying  ranges  are  POM  supported  and  champi¬ 
oned,  cyber  ranges  such  as  the  one  at  Keesler  have  no  funding  line  or 
advocates  in  the  POM  process.  Cyber  ranges  are  neither  properly 
funded  nor  sustained  to  meet  new  mission  challenges.  The  acquisi¬ 
tion  portion  of  this  study  states  that  funding  programs  reflect  what  a 
service  values  (see  chap.  2).  While  the  DOD  will  not  keep  pace  with 
cyber-development  cycles,  the  Air  Force  needs  to  stay  in  that  ballpark 
with  procurement.  The  service  must  find  ways  to  make  cyber  training 
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and  education  adaptive  to  the  developments  in  the  field  (OPR:  SAF/ 
FM,  AFSPC,  AETC,  24th  AF).42 

Standardization  and  Jointness 

Students  in  the  cyber  schoolhouses  are  meeting  the  initial  qualifi¬ 
cations  for  their  given  AFSCs.  For  example,  the  Business  and  Enter¬ 
prise  Systems  Office  believes  that  enlisted  personnel  (about  300  of  the 
3D0X4  programmers)  arrive  at  Maxwell  Gunter  Annex  well  trained 
by  the  AETC  system.43  That  said,  they  still  require  about  one  year  of 
OJT  before  being  completely  trained  and  able  to  accomplish  the  mis¬ 
sion.  As  with  other  AFSCs,  manpower  documents  assume  these  Air¬ 
men  to  be  fully  productive  upon  arrival  at  their  units;  however,  that 
assumption  is  untrue  across  most  of  the  cyber  enterprise. 

For  many  Airmen,  specific  mission  qualification  training  occurs  in 
their  units,  as  does  their  upgrade  and  continuity  training.  Unfortunately, 
as  of  this  writing,  many  units  have  no  credentialed  instructors  or  valid 
syllabi  to  prepare  those  Airmen  to  meet  mission-ready  standards.  For 
example,  Airmen  in  the  areas  of  cybersecurity  and  control  systems,  Air 
Force  intranet  control,  and  cyber  defense  analysis  receive  their  “finish¬ 
ing”  training  in  their  units.  Therefore,  such  training  will  not  be  standard 
across  the  Air  Force.  As  with  other  specialties,  such  as  pilots  and  mis¬ 
sileers,  recurring  training  for  cyber  Airmen  is  a  must.  Such  training  may 
also  need  to  be  conducted  more  often  to  keep  up  with  the  dynamics  of 
the  cyber  domain,  but  it  is  absent,  as  is  the  standardization/evaluation 
process.  Further,  unlike  their  flying  counterparts,  many  cyber  units 
have  no  budget  or  manning  for  in-house  training.  It  all  comes  from 
their  existing  funds.  The  result  is  a  lack  of  standardization  for  students 
and  an  additional  workload  for  unit  members. 

In  a  more  standardized  approach,  the  39  IOS  handles  OJT  and  mis¬ 
sion  qualification  for  Airmen  in  the  cyber  warfare  operations  control 
center  application;  cyber  vulnerability/hunt;  Air  Force  cyber  defense; 
and  command,  control,  and  communications  mission  system  arenas. 
The  39th  sends  INWT  instructors  on  temporary  duty  (TDY)  with  the 
recently  graduated  students  to  their  gaining  units.  Once  there,  the  39th 
instructors  conduct  OJT  /  mission  qualification  instruction  with  stu¬ 
dents  using  the  gaining  units’  systems  for  two  to  four  weeks.  This  pro¬ 
cess  completes  the  upgrade  of  the  students  to  mission-ready  status.  The 
TDY  cost  is  considerable,  but  the  current  belief  is  that  this  method  not 
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only  is  less  expensive  than  establishing  training  systems  for  all  stu¬ 
dents  at  Hurlburt  but  also  creates  a  more  uniform  training  result. 

Standardized  training  has  benefits  for  both  the  Air  Force  and  the 
joint  community  Joint  ranges  might  become  useful  and  cost  effective, 
as  could  joint  schoolhouses.  The  DOD  continues  to  work  more  jointly, 
and  j  oint  training  could  facilitate  the  movement  into  j  oint  cyber  opera¬ 
tions.  As  the  DOD  moves  toward  the  NICE  cybersecurity  workforce 
standards  for  KSAs,  curricula  should  conform  to  that  common  cyber¬ 
security  structure.  Since  Air  Force  career  fields  and  training  already 
closely  track  the  NICE  framework,  it  makes  sense  to  capitalize  on  that 
training  and  open  the  door  to  train  for  the  other  services  as  well.  A 
joint  facility  would  help  to  fulfill  the  Air  Forces  needs,  bring  the  DOD 
under  one  training  regime,  and  save  scarce  training  dollars. 

Sustaining  Materials  and  Skills 

Maintaining  up-to-date  course  materials  and  keeping  Airmens 
skills  current  is  a  challenge.  Cyberspace  is  constantly  changing,  and 
keeping  courses  relevant  is  difficult — especially  for  those  with  a  formal 
review  process.  TTPs  in  the  cyber  domain  change  on  90-day  cycles, 
but  some  course  updates  take  years  to  complete.  Some  curricula  at 
the  Keesler  schoolhouse  can  be  quickly  adapted.  However,  much  of 
the  work  is  still  done  the  old-fashioned  way  with  a  cumbersome  cur¬ 
riculum  review  cycle.  Even  so,  the  team  at  Keesler  frequently  updates 
certain  blocks  of  instruction.  For  example,  the  threats  block  is  con¬ 
tinually  updated  with  the  latest  threat  information  regarding  viruses 
and  malware.  The  AETC  curriculum  review  pipeline  must  be  stream¬ 
lined  so  that  schoolhouses  will  be  able  to  assure  cyber  curriculum 
relevance  with  the  operational  needs  of  the  cyber  force.  Similarly, 
keeping  course  material  current  in  a  dynamic  cyber  training  domain 
cannot  be  done  with  traditional  print  media.  Continual  updates 
through  various  digital  media  are  essential  to  keep  the  cyber  force 
current.44  For  the  cadre  at  the  39  IOS,  updating  curriculum  based  on 
the  Twenty-Fourth  Air  Force’s  task  training  list  can  take  as  little  as 
one  week,  allowing  for  rapid  adjustments  as  TTPs  change. 

The  latest  system  configurations  and  equipment  are  not  taught  at 
Keesler,  but  they  should  be.  Our  student  cyberspace  warriors  need 
robust  training  in  the  IPv6  framework.  As  IPv4  becomes  saturated, 
the  IPv6  framework  will  grow  in  use  and  operational  significance 
(see  the  chap.  2  discussion  on  IPv6).  AFSPC  and  Twenty-Fourth  Air 
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Force  should  address  this  need  with  training  tasking  letters  to  the 
schoolhouses  for  incorporation  into  initial  and  follow-on  courses. 

Once  trained,  cyber  warriors  must  maintain  their  currency,  espe¬ 
cially  when  they  rotate  to  different  positions.  As  with  pilots  transi¬ 
tioning  back  to  the  cockpit  after  a  school  tour,  what  would  the  transi¬ 
tion  back  to  the  “cyber  cockpit”  involve?  The  dynamic  cyberspace 
environment  makes  cyber  skills  highly  perishable.  One  option  for 
alleviating  this  problem  is  fewer  moves  for  cyber  warriors.  Another 
might  be  to  rotate  them  into  positions  in  which  they  can  maintain  a 
level  of  currency,  thereby  reducing  retraining  time  when  they  return 
to  operational  status.45  Continuous  learning  is  not  optional  in  the  cy¬ 
ber  defense  field.  To  that  end,  this  study  recommends  that  HAF  All 
A3/A6  examine  the  possibility  of  a  single  cyberspace  transition 
course  or  work  with  USCYBERCOM  and  the  joint  community  to 
create  a  replacement  training  unit  (RTU)  or  transition  course  (OPR: 
HAF  A1/A6,  24th  AF). 

Update  Process  for  AETC  Undergraduate  Cyber  Training 
Curriculum 

In  discussion  with  operations  units,  the  research  team  found  that 
substantial  manpower  was  devoted  to  training  new  accessions  in  cyber 
developments  in  areas  that  UCT  could  have  addressed.  Follow-on 
discussions  with  staff  at  AETC/ A3  revealed  that  the  curriculum  revi¬ 
sion  timeline  for  UCT  was  incapable  of  keeping  pace  with  the  evolving 
technology  of  cyber.  The  undergraduate  schoolhouse  at  Keesler  gen¬ 
erally  operates  with  an  18-month  lag  over  current  practice.  The  gap  is 
then  covered  by  operational  units  when  a  new  accession  reports  for 
operations  duty  and  goes  through  unit-specific  training. 

The  lag  for  the  UCT  curriculum  is  a  product  of  risk  mitigation 
strategies  for  a  new  curriculum — seeking  to  ensure  that  it  is  ready  to 
be  taught  and  instructors  are  properly  trained.  Attempting  to  speed 
up  this  timeline  is  risky  from  a  curriculum  development  standpoint. 
AETC  staff  argued  that  the  Instructional  Systems  Development  (ISD) 
process  takes  considerable  time. 

This  study  finds  that  the  ill-prepared  nature  of  graduates  from 
UCT  can  be  remedied  through  a  two-pronged  effort,  both  parts  of 
which  are  currently  under  way.  First,  in  negotiations  about  the  course 
content  of  UCT,  AFSPC  should  insist  that  the  course  be  monitored 
and,  if  necessary,  modified  to  keep  it  current  with  emerging  threats 
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and  technology.  Second,  AFSPC  and  AETC  should  establish  a  robust 
working  relationship  parallel  to  that  between  the  39  IOS  and  AFPC, 
whereby  lesson  plans  are  revised,  through  mutual  effort,  at  least  once 
every  180  days,  with  course  sections  on  fundamental  technologies 
revised  at  least  annually  Doctrinally  based  courses  are  updated  every 
18  months.  UCT  instructors  must  be  SMEs  and  should  be  personally 
responsible  for  their  lesson  plans. 

Air  Force  developmental  teams  ensure  that  initial  training  and  up¬ 
grade  training  create  technically  sound  cyber  members.  In  consulta¬ 
tion  with  training  stakeholders  (e.g.,  HAF  A2/A3/A6,  AETC,  and 
AFSPC),  the  teams  make  inputs  to  the  utilization  and  training  work 
groups  and  training  planning  teams.  They  assess  and  revise  courses 
based  on  the  ISD  process,  but  developing  education  or  training  stan¬ 
dards  is  time  consuming.  By  the  time  all  parties  sign  off  on  a  stan¬ 
dard,  it  may  well  have  become  obsolete.  To  overcome  this  problem, 
this  study  recommends  reforming  the  ISD  process  to  ensure  timely 
cyber  career  field  training  attuned  to  the  operational  environment. 
Along  these  lines,  HAF  A3/A6  is  reviewing  the  requirements  docu¬ 
ment  governing  the  UCT  curriculum.  By  becoming  less  restrictive 
with  its  specifications,  the  subsequent  requirements  document  will 
keep  pace  with  the  rapidly  evolving  cyber  domain,  allowing  courses 
to  maintain  operational  currency  between  triennial  reviews. 

As  indicated,  cyber  training  has  many  stakeholders,  including  the 
17-series  career  field  managers,  14N  managers,  AFSPC/ A3D  (which 
tracks  4Ns),  and  NSA/USCYBERCOM.  The  service  branches  and 
several  national  agencies  have  varied  cyber  training  paths  with  no 
curriculum  or  course  currency  requirements  standards.  Conse¬ 
quently,  levels  of  expertise  will  vary  within  the  Air  Force  and  across 
the  DOD.  Since  the  cyberspace  domain  is  so  pervasive  and  joint  in 
nature,  this  study  recommends  mapping  training  to  the  NICE  cyber¬ 
security  workforce  framework  for  KSAs  or  NICE  KSAs.  This  stan¬ 
dard  is  a  reasonably  good  one,  appropriate  not  only  for  the  Air  Force 
but  also  for  the  other  military  branches  and  government  agencies. 

Cyber  Instructors 

Sufficient  numbers  of  quality  instructors  are  necessary  for  success¬ 
ful  training.  It  takes  two  to  six  months  to  spin  up  a  qualified  officer  or 
NCO  to  become  an  instructor,  a  time  frame  not  unlike  those  of  other 
institutions  such  as  Squadron  Officer  College.  The  process  includes 
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shadowing  an  instructor  in  class,  teaching  under  the  supervision  of  a 
mentoring  instructor,  and,  finally,  independently  teaching  student 
cyber  warriors.  Instructors  must  remain  current  in  the  cyber  disci¬ 
pline  during  the  course  of  their  teaching  duties,  both  for  instructional 
purposes  and  in  preparation  for  their  follow-on  assignments.  They 
do  so  by  completing  continuing-education  short  courses  in  the  latest 
TTPs  in  use  by  friend  and  foe — at  a  minimum. 

The  Air  Force  cyber  schoolhouses  require  more  instructors  with 
operational  relevance — a  desirable  objective — but  schoolhouse  man¬ 
ning  is  always  short.  Releasing  instructors  for  continuing  education 
places  even  greater  burdens  on  those  who  remain,  especially  since 
only  66  percent  of  the  officer  cyber  instructor  billets  are  filled.46  The 
schoolhouses  must  also  contend  with  a  two-edged  sword:  They  would 
like  to  keep  instructors,  especially  the  very  good  ones,  for  longer  than 
the  typical  assignment  period;  however,  even  though  continuity  is 
desirable,  staying  in  the  schoolhouse  too  long  hurts  the  member’s  ca¬ 
reer  progression.  Schoolhouse  manning  should  be  investigated  to 
find  ways  to  maintain  adequate  numbers  of  instructors  while  allow¬ 
ing  for  their  proper  continuing  education  and  career  progression 
(OPR:  AETC/A1  [Manpower  and  Personnel]). 

Summary 

With  the  accelerating  changes  in  the  cyber  domain,  the  cyber  Air¬ 
men  of  today  will  differ  from  those  of  2020.  The  Air  Force  has  done  a 
remarkably  good  job  of  laying  a  foundation  for  its  cyber  force  and  is 
ramping  up  to  meet  the  challenge  of  producing  hundreds  more  trained 
cyber  warriors  for  the  mission  teams.  Nonetheless,  more  needs  to  be 
done,  especially  in  terms  of  educating  the  career  field.  Educating  and 
training  Air  Force  cyber  warriors  will  require  state-of-the-art  equip¬ 
ment  and  facilities,  expert  faculty,  and  rapidly  evolving  curricula. 


Recommendations  Summary 

•  To  overcome  the  problem  of  obsolete  standards,  reform  the  ISD  process 
to  ensure  timely  cyber  career  field  training  attuned  to  the  operational 
environment.  Along  these  lines,  HAF/A6SP  is  reviewing  the  requirements 
document  governing  the  UCT  curriculum.  To  keep  pace  with  the  rapidly 
evolving  cyber  domain,  the  subsequent  requirements  document  will  be 
less  restrictive  with  its  specifications,  thus  allowing  courses  to  maintain 
operational  currency  between  triennial  reviews. 
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Recommendations  Summary  ( continued ) 

•  Since  the  cyberspace  domain  is  so  pervasive  and  joint  in  nature,  map 
training  to  the  NICE  cybersecurity  workforce  framework  for  KSAs  or  NICE 
KSAs.  This  standard  is  a  reasonably  good  one,  appropriate  not  only  for  the 
Air  Force  but  also  for  the  other  military  services  and  government  agencies. 

•  HAF  A2/A3/A6  should  examine  the  possibility  of  a  single  cyberspace  tran¬ 
sition  course  or  work  with  USCYBERCOM  and  the  joint  community  to 
create  an  RTU  or  transition  course. 

•  Investigate  schoolhouse  manning  to  find  ways  to  maintain  adequate  lev¬ 
els  of  instructors  while  allowing  proper  continuing  education  and  career 
progression  for  instructors. 

•  The  USAF  must  find  ways  to  make  cyber  training  and  education  adaptive 
to  the  developments  in  the  field. 

•  The  best  way  to  increase  interest  in  the  1 7-series  AFSC  is  for  USAFA  custom¬ 
ers  to  tell,  and  then  prove  to,  cadets  that  the  Air  Force  has  good  jobs  for 
them.  Knowing  there  are  interesting  jobs  in  the  field  will  drive  up  interest. 

•  Creating  a  summer  course  for  cadets  would  be  useful  as  a  means  of  en¬ 
ticing  them  into  the  career  field.  Currently,  one  does  not  exist  (it  was 
eliminated  when  the  1 10  course  was  updated  and  offered  to  all  cadets  in 
their  first  year.) 

•  Maintain  steady  ROTC  budgets  to  hedge  against  the  risk  of  OTS  not  pro¬ 
ducing  adequate  quality/quantity  of  17D  accessions  when  the  economy 
picks  up. 

•  The  USAF  should  take  a  more  focused  look  at  how  the  two  Cyber  ACE 
programs  can  be  better  leveraged  to  help  meet  USAF  cyber  needs. 

•  To  continue  the  trend  of  developing  highly  capable  cyber  operators,  fully 
fund  and  expand  the  AFIT/AFRL  distinct  ACE  programs.  Fully  fund,  in 
POM,  the  AFRL/RI  ACE  program.  Fully  fund,  in  POM,  the  AFIT  ACE  pro¬ 
gram  for  ROTC. 

•  Mandate  an  AFIT  name  change  to  avoid  confusion  with  the  distinct  AFRL/ 
Rl  program.  Re-recognize  AFRL/RI  ACE  as  a  national  asset  and  a  CSAF 
special-interest  item. 
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Chapter  8 

Concluding  Thoughts 

With  cyberspace  underpinning  all  of  the  Air  Force’s  core  missions, 
the  cyber  workforce  will  be  vital  to  mission  success.  Every  Air  Force 
mission  requires  networked  connectivity  to  some  degree  or  another. 
Every  weapon  system  depends  on  data  and  signals,  both  internally  to 
ensure  platform  functionality  to  accomplish  Air  Force  missions  and 
externally  to  connect  and  work  with  the  rest  of  the  forces.  Therefore, 
as  this  study  found,  our  cyber  workforce  tasks  are  twofold:  (1)  recruit, 
educate,  train,  and  sustain  an  educated  workforce  that  understands 
the  dependencies  and  risks  that  cyberspace  may  pose  to  a  mission, 
and  (2)  develop  Airmen  in  career  fields  outside  cyber  to  apply  cyber 
operational  concepts  and  capabilities  to  actively  engage,  counter,  and 
mitigate  the  cyber  risks  posed  to  their  missions.  Without  addressing 
the  first  issue,  the  second  will  be  problematic. 

Regarding  the  first  area,  the  Air  Force  is  aware  of  the  challenges  in 
planning,  developing,  and  managing  a  complex  cyber  operations 
workforce.  However,  debates  are  ongoing  as  to  the  kind  of  person 
who  makes  a  good  cyber  operator.  Rooted  in  the  decision  to  migrate 
the  33S  (communications)  officers  into  the  17D  (cyberspace  officer) 
career  field  is  the  persistent  perception  that  cyber  means  anything 
concerning  IT.  The  conventional  wisdom  seems  to  be  that  IT  person¬ 
nel  in  DODIN  roles  are  cyber  operators  when  they  are  truly  serving 
an  important  enabling  function  that  overlaps  with  DCO.  DODIN  op¬ 
erators  fulfill  the  roles  of  system  administrators  (responsible  for 
patching),  network  administrators  (responsible  for  monitoring),  and 
security  operations  center  analysts  (responsible  for  collected  obser¬ 
vation  analysis  and  correlation).  They  fall  within  the  cyber  warrior 
spectrum  and  obviously  have  a  role  in  the  defensive  and,  if  engaged 
in  active  defense,  the  offensive  side  as  well.  Operators  in  this  specialty 
have  security  functions  in  establishing  and  maintaining  the  network 
in  accordance  with  best  practices  and  standards.  Since  experience  is 
critical  in  understanding  the  cyber  domain,  the  rotation  of  cyber  Air¬ 
men  between  DCO/OCO  and  DODIN  ensures  readiness. 

As  this  study  concludes,  the  management  of  IT  differs  from  the  con¬ 
duct  of  cyber  operations  to  meet  commanders’  intent  to  assure  missions 
in  support  of  national  security.  IT  and  OT  have  unique  attributes. 
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Much  of  the  IT  paradigm  is  concerned  with  enforcing  confidentiality 
versus  integrity  and  availability  of  information  systems.  Military  op¬ 
erations  rely  on  platforms  with  OT  embedded  with  them.  They  are 
thus  much  more  focused  on  system  integrity  and  availability.  Com¬ 
promises  of  these  two  elements  can  lead  to  immediate  mission  fail¬ 
ure,  whereas  violations  of  confidentiality  must  be  leveraged  in  con¬ 
junction  with  some  other  capability  to  produce  mission  failure  as  a 
second-order  effect.  We  thus  strongly  encourage  force  planners  not 
to  equate  traditional  IT  roles  with  mission  assurance.  As  has  been 
highlighted,  military  missions  rely  on  the  embedded  processors,  con¬ 
trollers,  and  other  elements  that  comprise  operational  IT. 

As  of  this  writing,  the  USAF  is  beginning  to  move  past  the  gener¬ 
alities  and  establish  some  definite  tactical/operational  requirements 
for  cyber  operators,  one  aspect  of  which  is  USCYBERCOM’s  Cyber 
Mission  Force.  CMF  constructs  deal  mainly  with  what  have  typically 
been  thought  of  as  the  DCO  and  OCO  sides  of  cyber  operations.  The 
rest  of  D  ODIN  ops  (build,  operate,  maintain,  and  secure  networks)  is 
not  in  that  construct.  The  DODIN  is  more  related  to  what  communi¬ 
cation  squadrons,  and  eventually  the  joint  information  environment, 
will  tackle  down  to  the  base  level.  The  CMF  construct  dictates  three 
types  of  teams  with  Cyber  Command:  cyber  protection  teams,  cyber 
mission  teams,  and  national  mission  teams.  The  basic  structure  de¬ 
fines  exactly  what  kinds  of  people  should  appear  on  each  kind  of 
team  (17  series,  14N,  1B4,  1NXX).  The  Air  Staff  as  the  cyber  force- 
development  lead  (A6S)  and  AFSPC/A3  (Directorate  of  Air,  Space, 
and  Information  Operations)  are  doing  the  operational  test  and  evalu¬ 
ation  for  that.  The  Airmen  on  those  CPTs,  CMTs,  and  NMTs  that  the 
Air  Force  provides  will  require  training  that  has  already  started  at  the 
UCT,  39  IOS,  and  AFIT  schoolhouses  and  that  Twenty-Fourth  Air 
Force  has  been  influencing  in  conjunction  with  the  Air  Staff  and 
AETC.  As  this  study  has  reiterated,  however,  we  still  have  a  long  way 
to  go  in  ensuring  an  up-to-date  curriculum  and  a  training  infrastruc¬ 
ture  at  the  schoolhouse — one  that  reflects  operational  challenges  be¬ 
yond  just  IP  network  operations. 

The  second  area — developing  Airmen  outside  cyber  to  recognize 
and  mitigate  cyber  risks  posed  to  their  missions — is  no  less  critical 
and  perhaps  the  greater  challenge.  Technological  solutions  alone  will 
not  solve  our  cyber  problems.  Cyber  operators,  planners,  and  strate¬ 
gists  must  be  developed  at  every  level  of  education.  The  need  will 
continue  for  creating  and  sustaining  a  cyber-aware  workforce  that 
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can  articulate  the  extent  to  which  cyber  puts  missions  at  risk  to  com¬ 
manders.  A  concurrent  need  will  exist  for  fostering  cyber-sawy  com¬ 
manders  who  grasp  their  missions  dependencies  on  the  domain. 
Shrinking  defense  budgets  and  commitments  to  our  core  mission 
areas  remain  obstacles  to  achieving  these  objectives.  Nonetheless,  the 
foundation  for  these  proficiencies  is  the  education  and  research  that 
enable  the  creation  of  innovative  concepts  to  develop  capabilities  that 
meet  a  commander’s  mission  needs  and  ensure  effective  operations 
with  an  extremely  high  level  of  certainty. 

The  Air  Force  is  communicating  that  it  places  a  low  value  on  edu¬ 
cating  cyberspace  professionals.  At  a  minimum,  the  service  is  losing 
the  battle  of  perceptions  with  the  other  services  that  have  built  or 
plan  to  build  cyber  research  centers  at  their  institutions  of  higher 
learning.  The  Military  Academy,  Naval  Academy,  Naval  Postgraduate 
School,  and  Naval  War  College  are  all  establishing  cyber  programs. 
Indeed,  as  of  this  writing  in  June  2015,  Air  University  is  establishing 
an  Air  Force  Cyber  College  that  will  blend  technology,  operations, 
and  strategy,  and  the  Air  Force  Academy  is  establishing  a  Cyber  In¬ 
novation  Center.  When  the  study  was  ongoing,  a  key  recommenda¬ 
tion  was  to  take  such  action  not  only  from  an  educational  perspective 
but  also  from  a  recruitment  standpoint.  A  prospective  cadet  or  re¬ 
cruit  interested  in  cyber  would  be  prone  to  choose  a  military  service 
based  on  the  visible  emphasis  it  puts  on  cyber.  The  Air  Force  must 
enhance  these  embryonic  efforts  with  the  appropriate  funding  and 
resources  when  it  comes  to  cyber,  or  it  will  eventually  suffer  the  con¬ 
sequences  and  potentially  lose  talent  to  other  services.  As  this  study 
has  indicated,  conveying  an  institutional  commitment  to  cyber  and 
developing  cyber  warriors  are  of  utmost  importance.  The  Air  Force 
clearly  displays  its  level  of  commitment  through  how  it  chooses  to 
operationalize  the  domain,  develop  its  human  capital,  and  equip  its 
cyber  forces.  We  therefore  strongly  urge  the  establishment  of  a  robust 
cyber  capacity  at  Air  University,  where  the  art  and  science  of  cyber 
operations  and  strategy  can  be  crafted  to  guide  the  force. 

Continuous  learning  in  cyberspace  is  also  mandatory — analogous 
to  the  continuing  training  that  a  pilot  receives.  Like  pilots,  cyber  op¬ 
erators  cannot  be  away  from  operations  for  very  long  and  retain  cur¬ 
rency.  Maintaining  a  level  of  future  awareness  and  an  exposure  to 
new  ideas  is  necessary.  Therefore,  we  need  a  cohort  of  quality  Airmen 
who  understand  the  domain  and  know  how  to  operationalize  it.  To¬ 
day  the  Air  Force  focuses  on  “poles  and  wires”  in  cyberspace.  The 
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result  is  that  we  have  tactics  masquerading  as  strategy  and  doctrine 
that  lacks  true  utility.  AU  has  a  significant  role  in  balancing  the  art 
and  science  of  cyber  conflict  in  a  meaningful  way  to  operationalize 
the  cyber  domain.  In  cyberspace,  the  USAF  cannot  simply  develop  its 
strategic  approach  based  on  past  lessons  from  air  and  space  strategy 
and  then  expect  to  sprinkle  some  “cyber”  on  it.  Rather,  the  service 
needs  to  effectively  blend  air,  space,  and  cyber  power  from  the  onset 
of  campaign  design  to  maximize  the  inherent  advantages  of  each  of 
the  Air  Force’s  five  core  mission  areas  and  fuse  them  into  an  elegant 
whole  that  cannot  be  disaggregated.  Doing  so  requires  not  only  cyber 
operators  but  also  mission  planners  who  understand  the  risk  to  their 
operations  in,  through,  and  by  means  of  cyber — an  area  we  identified 
as  a  critical  gap  that  AU  is  in  a  unique  position  to  address. 

The  USAF  needs  to  recognize  the  dynamics  that  will  exist  in  the 
cyber  domain  and  the  ways  they  apply  to  a  force  structure.  This  study 
presented  solutions  for  how  the  Air  Force  can  develop  cyber  leaders 
while  ensuring  that  it  educates  and  trains  cyber  operators.  Good  cy¬ 
ber  leaders  need  to  be  competent  experts  in  the  field.  Offering  a  con¬ 
tinuity  of  assignments  will  promote  having  leadership  with  the  expe¬ 
rience  to  operationalize  the  cyber  domain.  Cyber  leaders  should  be 
able  to  fulfill  the  traditional  leadership  roles  of  mentoring  and  pro¬ 
viding  direction;  they  should  also  cultivate  team  resources  (a  process 
that  includes  developing  individual  skills,  devising  team  approaches 
to  development  and  operations,  and  managing  human  resources). 

For  retaining  a  quality  cyber  workforce,  the  government  pay/grade 
structure  as  it  stands  today  isn’t  competitive  with  that  of  the  private 
sector.  It  will  never  be.  However,  salary  is  not  the  primary  motivating 
factor  with  the  incoming  millennials.  They  want  to  be  challenged, 
receive  rapid  feedback,  and  contribute  through  public  service;  more¬ 
over,  they  don’t  want  to  be  dragged  into  too  much  administrivia.  That 
said,  there  are  hurdles  to  retention  as  the  nationwide  demand  for  cy¬ 
ber  talent  increases.  The  effect  of  the  revolving  door  of  military-to- 
contractor  personnel  exchanges  on  retention  needs  to  be  further  ex¬ 
plored,  along  with  legal  instruments  such  as  noncompete  clauses  that 
would  bar  recruitment  of  USAF  personnel  from  the  operational  floor 
by  companies  fulfilling  contracts  there. 

We  cannot  solve  every  problem  related  to  the  application  of  cyber 
and  electronic  warfare  across  core  functions.  However,  as  the  intel¬ 
lectual  center  of  the  Air  Force,  AU  owes  it  to  the  service  and  the  na¬ 
tion  to  conduct  research  necessary  to  begin  the  development  of  ro- 
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bust,  rigorous,  and  scalable  methodologies  that  enable  Airmen  both 
to  frame  and  to  solve  institutional  problems  in  a  more  useful  manner. 
As  a  result,  we  must  lead  the  development  of  theory  necessary  to  secure 
the  advantage  enabled  by  effective  integration  of  cyber  advances  into 
the  Air  Force’s  strategic,  operational,  tactical,  technical,  and  policy 
decisions.  The  emergent  operational  concepts  and  strategic  policies 
will  allow  the  Air  Force  and  the  nation  to  mature  and  develop  their 
cyber  forces.  We  find  that  our  Air  Force  is  leading  the  nation  down 
this  very  path  today. 


Appendix 

Overall  Recommendations  and  Status 
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Key  Recommendations 


Organize 

Educate/Train 

Equip 

Use  economic  indicators 
with  existing  manning 
and  retention  stats  to 
adjust  selective  reenlist 
bonuses  to  mitigate 
manning  crisis  levels. 
(AFPC) 

Examine/implement  reforms 
to  Instructional  Systems 
Development  (ISD)  process 
with  career  field  to  ensure 
that  education  and  training 
are  attuned  to  the  opera¬ 
tional  environment.  (AETC/ 
AFPSC) 

Mandate  IPv6  transition 
for  the  USAF's  operational 
benefit.  (HAF/A6/AFNIC) 

Recognize  cyber  as  a 
separate  domain  with 
separate  language  / 
social  science  require¬ 
ments,  and  catalog 
personnel  identified/ 
recruited. 

Map  curriculum  to  National 
Initiative  for  Cybersecurity 
Education  (NICE)  knowl¬ 
edge,  skills,  and  abilities 
(KSA)  to  ensure  interagency 
relevance. 

Investigate  use  of  cyber 
competitions  for  recruiting. 

Actively  contribute  to 
Internet  governance.  (A6/ 
AFRL/AU) 

Incorporate  Department 
of  Homeland  Security 
(DHS)-NICE  framework 
across  cyber  career 
fields.  (A6S) 

Enhance  the  IPv6  network¬ 
ing  and  software  pro¬ 
gramming  in  curriculum. 
(AFSPC/AETC) 

Equip  schools  consistent 
with  POMed  (requested 
in  program  objective 
memorandum)  lab/range 
equipment,  including 
software/hardware. 

Create  electronic  posi¬ 
tion  description/tracking 
mechanism  mapped  to 
NICE.  Investigate  use 
of  special  experience 
identifiers  (SEI)  to  track 
specialized  cyber  skills 
for  assignments.  (A1 ) 

In  lean  years,  give  the  1  B4 
career  field  priority  for 
tuition  assistance  and  other 
like  programs  in  cyber- 
related  fields. 

Integrate  acquired  systems 
to  avoid  a  "patchwork 
quilt"  of  systems  and 
software.  (AFSPC,  SAF/AQ, 
AFMC) 

Mandate  that  cyber 
units  code  their  billets 
for  advanced  academic 
degrees  (AAD). 

Fully  fund  the  Air  Force 
Institute  of  Technology 
(AFIT)  /  Air  Force  Research 
Laboratory  (AFRL)  distinct 
Advanced  Cyber  Education 
(ACE)  programs  (change 

AFIT  program  name);  esti¬ 
mated  cost  is  $1 ,6M. 

Emphasize  software  as¬ 
surance,  and  incentivize 
contractors  to  use  best 
practices. 

USAFA  customers 
should  create  demand 
signal  to  cadets  that 
there  are  good  jobs  for 
them  as  1 7D/Ss.  Create 
a  summer  course  for 
cadets  as  a  means  of 
enticing  them  into  the 
career  field.  (USAFA) 

Ramp  up  cyber  AAD  pro¬ 
duction  (including  AFIT)  to 
meet  identified  demand. 
Create  a  cyber  hygiene 
curriculum  for  accessions 
programs.  (AETC) 

Develop  technical  cyber 
acquisition  certification 
similar  to  that  for  engi¬ 
neering. 
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Recommendations:  Connecting  Technology 
and  Policy  (Chap.  2) 


Recommendation 

Implementation/Status 

1 

Manpower  planners  must  account  for  the  Joint 
Information  Environment  (JIE)  and  other  sys¬ 
temic  technological  paradigm  shifts  as  they  as¬ 
sess  their  5-to-1 0-year  workforce  requirements. 

In  Progress:  HAF/A6SP 

2 

The  DOD  and  USAF  should  document  their 
roles  and  provide  metrics  on  their  participation 
and  position  with  Internet  governance  bodies. 

HAF/A6 

3 

The  USAF  chief  information  officer  (CIO) 
should  develop  and  establish  enforcement 
mechanisms  to  ensure  standard  Air  Force-wide 
information  technology  (IT)  configurations, 
allowing  better  network  integration  and  fewer 
base-specific  failures  with  security/network 
defense  tools. 

HAF/A6P 

4 

The  USAF  should  embed  the  life-cycle- 
management  process  as  part  of  its  cyber 
decision  making. 

In  Progress:  AFSPC,  SAF/ 

AQ,  AFMC  Air  Force  Busi¬ 
ness  and  Enterprise  Systems 
(BES)  Directorate,  and 

SECAF  initiated  "Bending 
the  Cost  Curve  Program" 

5 

The  USAF  should  increasingly  rely  on  its 
enlisted  programmers  to  supply  the  talent  to 
perform  many  software  assurance  activities.  Al¬ 
though  civilians  and  officers  can  perform  these 
functions  admirably,  they  are  often  considerably 
more  expensive  to  obtain  and  retain. 

AFPC 

6 

The  DOD  and  Air  Force  should  provide  ad¬ 
equate  incentives  for  secure  programming  that 
far  exceeds  the  level  necessary  to  avoid  liability. 

SAF/AQ 

Research  on  methodology 
in  progress:  AU 

7 

The  USAF  should  examine  holding  vendors 
financially  liable  for  inept  software  designs  and/ 
or  coding  that  leaves  systems  vulnerable. 

SAF/AQ 

Research  on  methodology 
in  progress:  AU 

8 

Incorporate  the  DHS's  NICE  framework  across 
cyberspace  career  fields. 

In  Progress:  HAF/A6SP 

9 

Create  electronic  professional  development  track¬ 
ing  mechanism  (such  as  SEIs)  mapped  to  NICE. 

HAF/A1 ,  SAF/A6SP,  AFPC 

10 

Recognize  cyberspace  as  a  domain  with 
language  and  social  science  requirements,  and 
catalog  personnel. 

HAF/A1/A2,  AFPC 

11 

Mandate  a  firm  transition  date  to  IPv6  utilizing 
DOD  acquisition  policies  and  the  JIE. 

CSAF 

12 

The  USAF  needs  to  ensure  that  adequate  train¬ 
ing  exists  on  cyberspace  ranges  within  IPv6  en¬ 
vironments  for  cyberspace  operators.  All  current 
operators  need  to  be  proficient  in  IPv6  now. 

A6SF,  24th  AF,  AETC/AFSPC 
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Recommendations:  Connecting  Technology 
and  Policy  (Chap.  2)  ( continued ) 

Recommendation  Implementation/Status 

13  The  DOD,  particularly  the  USAF,  should  take  HAF/A6,  AETC/AU,  AFSPC 
a  more  active  role  in  the  development  of  the 

cyberspace  infrastructure  and  the  standards 
and  norms  of  Internet  governance  mirroring  its 
actions  in  the  domain  of  space  at  International 
Telecommunication  Union  (ITU)-Radiocommu- 
nications. 

14  The  USAF  should  develop  and  implement  pro-  Development  in  Progress: 
prietary  protocols  designed  to  be  mathemati-  AFRL/RI 

cal ly  secure.  Implementation  A6P 

15  Broadband  mobility  provides  opportunities  to  A1 
engage  with  target  audiences;  social  scientists 

and  linguists  will  be  critical  to  do  so  effectively. 

The  USAF  needs  to  ensure  that  it  has  an  ad¬ 
equate  number  of  linguists  and  social  scientists 
educated  /  trained  /  experienced  in  cyberspace 
operations. 

16  Develop  formal  partnerships  between  the  In  Progress:  HAF/A6WW 

engineering  communities,  which  understand  "Cybersecurity  Taskforce" 
operational  IT,  and  the  cybersecurity  communi¬ 
ties,  which  understand  network  IT,  to  mitigate 

vulnerabilities  and  manage  risk  to  critical 
infrastructure. 

17  Bring  together  a  core  group  of  programmers 
who  can  disseminate  best  practices  throughout 
the  Air  Force. 

18  Ensure  a  baseline  level  of  quality  is  achieved  in 
the  implemented  software.  Toward  that  end,  the 
Air  Force  should  devote  sufficient  resources  to 
this  important  task  since  doing  so  is  certainly 
preferable  to  continuation  of  the  recent  hacking 
of  weapon  systems  data. 

19  Big-data  analytics  will  require  greater  emphasis  24th  AF/25th  AF,  HAF/A1 
in  the  future,  and  the  USAF  and  DOD  will  need 

to  be  able  to  recruit,  train,  and  track  analysts 
capable  of  manipulating  big-data  sets.  Examine 
the  need  for  big  data  analysts,  establish  formal 
requirements  to  address  these  needs,  and  work 
to  establish  a  mechanism  to  identify  and  track 
expertise. 

20  Cultivate  a  culture  of  understanding  the  differ-  AU 
ences  between  IT  and  OT  to  serve  as  a  founda¬ 
tion  for  discussion  of  the  cyber  dependencies  of 
core  Air  Force  missions. 
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Recommendations:  Recruit,  Retain,  Regain  (Chap.  3) 

Recommendation  Implementation/Status 

21  Examine  ways  to  give  opportunities  to  Airmen  in  HAF/A1 
other  career  fields  to  transfer  into  1  7X/1  B4/3D 

or  cyber-related  civilian  career  fields. 

22  The  cyber  test  could  be  one  way  to  allow  In  Progress:  AFRL/71 1 HPW, 

Airmen  from  other  Air  Force  specialty  codes  AETC/A1 

(AFSC)  who  have  an  interest  in  cyber  or  have 
computer  science  (CS),  computer  engineering 
(CE),  or  electrical  engineering  (EE)  degrees  to 
demonstrate  their  aptitude  to  be  cyber  warriors. 

23  The  USAF  should  not  put  national  security  mis-  Ongoing:  AFRS 
sions  at  risk  by  actively  seeking  to  recruit  from 

the  destructive  hacker  pool.  Instead,  leverage 
games  and  competitions  to  serve  as  an  outlet  for 
people  with  inquisitive  hacking  skills  and  instill 
our  core  values  into  those  who  aspire  to  join  the 
ranks  of  the  "good  guys"  defending  the  nation 
in  the  role  or  capacity  they  choose. 

24  The  USAF  should  explore  the  legalities  of  in-  HAF/A1,  SAF/AQ 
eluding  noncompete  clauses  within  contractor 

agreements  so  contractors  are  prohibited  from 
recruiting  or  hiring  current  USAF  employees 
who  are  not  retiring  within  one  year. 

25  Recruit  cyber-educated  Airmen  from  the  1  B4, 

1  NX,  and  3D  career  fields. 

26  Offer  tuition  assistance — especially  in  CE 
or  EE— to  Airmen  in  the  1  B4,  1  NX,  and  3D 
specialties  to  enhance  their  education  in  cyber 
fields. 

27  Continue  to  produce  a  portion  of  cyber  opera¬ 
tors  from  the  arts,  humanities,  and  social  sci¬ 
ences  to  assure  that  cyber  professions  include  a 
cadre  of  creative  thinkers. 

Recommendations:  Understanding  the 
Impact  of  Millenials  on  the  Cyber 
Workforce  (Chap.  4) 

Recommendation  Implementation/Status 

28  The  USAF  should  highlight  its  health-care  ben-  AFRS 
efits  and  high  promotion  potential  as  it  attempts 

to  recruit  from  a  smaller  pool  of  qualified  18-to- 
24-year-old  millennials. 

29  The  USAF  can  improve  its  millennial  recruiting  AFRS 
by  appealing  to  the  desire  of  young  Americans 

to  promote  peace  and  security  more  broadly 
and  their  role  in  performing  that  function  as  a 
USAF  member.  Given  its  technical  focus,  the 
USAF  is  particularly  well  positioned  to  appeal 
to  this  desire. 
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Recommendations:  Understanding  the 
Impact  of  Millenials  on  the  Cyber 
Workforce  (Chap.  4)  ( continued ) 

Recommendation  Implementation/Status 

30  In  many  respects,  the  highly  skilled  jobs  that  are  AFRS 
the  hallmark  of  the  USAF  are  one  of  its  greatest 
recruiting  tools.  The  unique  DOD  mission  set 

(Title  10)  is  attractive  and  should  be  leveraged  in 
recruitment  campaigns. 

31  Include  a  short  course  in  cyber  hygiene  that  AETC,  USAFA,  AF-CIO 

achieves  analysis-level  learning  objectives  in 

cyber  information  assurance  operations  as  part  of 
all  accessions  programs:  Basic  Military  Training 
(BMT),  Officer  Training  School  (OTS),  US  Air 
Force  Academy  (USAFA),  and  Reserve  Officer 
Training  Corps  (ROTC). 

32  Follow-on  studies  should  look  closely  at  the  HAF/A1/A2 

cyber  intelligence  collection  field  (1 N2)  and 

examine  the  enlisted  3DXX  career  field  set  more 
thoroughly. 

33  Although  the  USAF  should  continue  to  work  with  HAF/A6S 
the  DHS  in  implementing  the  NICE  framework, 

it  should  not  undertake  wholesale  changes  to  the 
2210  civilian  occupational  specialty  until  the 
framework  is  finalized.  The  Office  of  Personnel 
Management  (OPM)  will  not  complete  reclas¬ 
sification  of  the  cyber  civilian  workforce  until  at 
least  201 8. 

34  Build  a  robust  14XX  website  for  the  1 4N  career  In  Progress:  HAF/A2, 
field,  maintained  by  HQ  AFPC,  and  clearly  com-  AFPC 

municate  that  website's  location  to  the  field. 

35  The  functional  manager  for  the  14XX  career  field  In  progress:  HAF/A2, 
should  consolidate  all  documents  and  manage-  AFPC 

ment  of  the  career  field  at  the  corporate  USAF 
level  and  work  with  AFPC  to  publish  the  appro¬ 
priate  USAF-level  guidance. 

36  The  intelligence  community,  including  Twenty-  In  progress:  17TW,  AETC/ 
Fifth  Air  Force,  should  reexamine  the  Intelligence  A3,  25th  AF,  HAF/A2 
Officer  Course  to  determine  if  recent  events  in 

cyberspace  warrant  adjustment  of  course  content 
and  reallocation  of  time  across  the  various  intel¬ 
ligence  disciplines  and  competencies. 

37  Cyberspace  1 4Ns  should  be  assigned  a  minimum  HAF/A2 
of  two — preferably  three — back-to-back  cyber¬ 
space  tours  before  career  broadening  into  other 

areas  to  reduce  the  training  demand  and  create 
more  highly  experienced  cyberspace  intelligence 
officers. 
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Recommendations:  Force  Development 
(Chap.  5) 

Recommendation  Implementation/Status 

38  Because  the  career-path  tool  is  not  currently  in  In  progress:  HAF/A2,  25th 
active  use  at  AFPC,  give  1 4Ns  an  SEI  that  tracks  AF,  and  AFPC 
their  specialized  expertise  and  makes  it  easier 
for  the  assignment  system  to  manage  them  as  the 
specialized  resource  they  are. 


39 


Economic  trends  should  be  monitored  closely, 
and  the  personnel  community  should  stand  ready 
on  short  notice  to  implement  retention  and  ac¬ 
cessions  incentives  should  these  trends  appear 
and/or  grow  worse. 


HAF/A1  with  offices  of 
collateral  responsibil¬ 
ity  (OCR)  A6SP,  AFSPC, 
24th  AF 


40  Develop  a  cyber  College  Level  Examination  AETC 

Program  (CLEP)  exam  for  Undergraduate  Cyber 
Training  (UCT)  for  personnel  with  deeper  cyber 
education  or  experience.  This  test  would  create 
additional  on-ramps  for  individuals  to  enter  the 
program  and  potentially  help  avoid  repeated 
training  for  officers  with  technical  degrees,  such 
as  CS,  CE,  and  EE.  Those  time  savings  could 
shorten  the  pipeline  for  some,  leaving  the  UCT 
course  for  others  without  the  requisite  education 
or  experience. 


41  Due  to  the  need  for  stable  accessions  of  techni-  HAF/A1 D,  AU,  USAFA, 

cal ly  savvy  officers  in  the  cyber  domain  and  the  SAF/FM,  AETC 

stability  that  ROTC  and  the  USAFA  confer  in  of¬ 
ficer  accessions,  we  recommend  that  for  the  time 
frame  of  this  study  the  Air  Force  plan  to  access 
all  its  cyberspace  officers  entirely  through  the 
USAFA  and  ROTC. 


42  Establish  a  formal  transition  course  for  operators  AETC,  24th  AF 
on  the  national  mission  teams  (NMT),  national 

support  teams,  cyber  mission  teams  (CMT),  cyber 
support  teams,  and  cyber  protection  teams  (CPT). 

This  course  should  be  critical,  as  is  true  in  the 
rated  force,  for  those  who  spend  more  than  1 2 
months  but  fewer  than  48  months  away  from  the 
operations  floor.  Beyond  a  48-month  absence, 
this  study  recommends  attainment  of  full  mission 
requalification. 

43  Make  all  cyberspace  training  ranges  (including  AETC,  AFSPC,  SAF/FM 
those  at  Keesler  AFB  and  Hurlburt  Field)  formal 

programs  embedded  within  the  POM  process 
in  the  same  manner  as  the  training  ranges  in  the 
air  domain.  The  POM  process  should  be  used 
for  maintenance,  operations,  and  upgrade  of  the 
facilities  on  a  planned  rather  than  ad  hoc  basis. 

44  Prioritize  the  1  B4  career  field  for  allocation  of  HAF/A1 
tuition  assistance  and  other  academic  programs 

in  those  fiscal  years  when  resources  are  tight. 
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Recommendations:  Force  Development 
(Chap.  5)  (continued) 

Recommendation  Implementation/Status 

45  The  A1  should  make  deliberate  use  of  the  Confer-  HAF/A1 
ence  Board's  Leading  Economic  Index  (often 
called  the  index  of  leading  economic  indica¬ 
tors)  in  combination  with  existing  manning  and 
retention  statistics  to  adjust  selective  reenlist¬ 
ment  bonuses  and  other  retention  incentives  to 
curb  adverse  manpower  trends  before  manning 
reaches  crisis  levels. 


46  Because  language  is  developing  into  a  greater  24th  AF 
cyber  enabler,  Air  Forces  Cyber  (AFCYBER) 
should  evaluate  the  various  languages  in  which 
programming  is  currently  found  and  establish 
the  requirements  for  programming-proficient 
foreign  linguists.  Once  these  requirements  are 
established,  it  should  conduct  an  analysis  of 
alternatives  to  determine  whether  this  need — of¬ 
ten  episodic — is  best  met  by  military,  civilian, 
or  contract  personnel  and  whether  physical  or 
virtual  availability  is  sufficient. 


47  DOD  senior  language  authority  should  initiate  DOD  senior  language 
planning  for  a  Defense  Language  Proficiency  Test  authority 

(DLPT)  writing  test  using  the  existing  American 
Council  on  the  Teaching  of  Foreign  Languages 
(ACTFL)  2012  Writing  Proficiency  Test  as  a  guide. 

48  Add  a  computer  coding  component  to  this  HAF/A2 

linguistic  testing  to  identify  potential  cyberspace 
linguistic  analysts.  Once  individuals  with  these 

skills  are  identified,  establish  a  special  cyber 
experience  identifier  for  cyber  linguists  to  enable 
tracking  them  in  the  various  personnel  databases. 


49 


Since  the  ability  to  read  programming  language 
in  a  foreign  tongue  is  not  a  skill  for  which  all  lin¬ 
guists  are  suited,  manage  those  who  develop  this 
skill  similarly  to  their  1  N4X1 A  counterparts,  with 
an  emphasis  on — but  not  necessarily  exclusive 
use  of — service  in  cyberspace  roles  and  missions. 


HAF/A1  (USAF  Senior 
Language  Authority), 
AFPC's  14NB  Cyber 
Operations  Assignment 
Team,  and  the  assignment 
manager  for  airborne 
cryptanalysts  (1 A8X1  as¬ 
signments) 


50  Until  the  new  cyber  linguist  cohort  is  fully  estab-  HAF/A1 D  (USAF  Senior 
lished,  use  Guard  and  Reserve  assets  to  address  Language  Authority) 
any  short-term  manning  shortfalls.  As  the  cyber 
linguist  mission  matures,  Guard  and  Reserve  sup¬ 
port  in  this  area  may  also  grow.  To  fill  this  role, 
these  components  will  need  to  implement  track¬ 
ing  procedures  for  foreign  language  expertise  as 
indicated  above. 
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Recommendations:  Force  Development 
(Chap.  5)  ( continued ) 


Recommendation 

Implementation/Status 

51  Maintain  a  tracking  system  of  this  expertise  on 
all  operational  cyberspace  floors  to  ensure  that, 
when  needed,  these  experts  can  be  called  upon 
in  a  short  period  of  time — a  condition  analogous 
to  quick-reaction  alert  status. 

AFPC 

52  Due  to  the  rapidly  changing  nature  of  the  cyber  AFCYBER 
domain,  AFCYBER  should  review  these  language 
requirements  and  their  tracking  mechanism  no 

less  than  once  every  two  years  as  part  of  the 
formal  POM  cycle. 

53  Because  cyberspace-specific  skills  overlap  several  HAF/A2,  A6SP 
specialties,  examine  the  prospects  of  establish¬ 
ing  a  single  cyberspace  transition  course  for  all 

personnel  returning  to  the  cyberspace  field  after 
lengthy  periods  away  or  working  with  US  Cyber 
Command  (USCYBERCOM)  and  the  associated 
joint  community  to  create  such  a  course. 

54  AFCYBER  and  Twenty-Fifth  Air  Force  should  AFCYBER,  A1 

collectively  and  comprehensively  examine  the 

needs  for  big-data  analysts,  establish  formal 
requirements  to  address  these  needs,  and  then 
work  with  A1  to  create  a  mechanism  for  the 
identification  and  tracking  of  this  specialized 
expertise  within  the  Air  Force  personnel  system. 


Recommendations:  The  Air  National  Guard,  the  Air  Force 
Reserve,  and  Cyber  (Chap.  6) 

Recommendation 

Implementation/Status 

55  Reassess  the  cost  of  active  duty  "when  not  acti¬ 
vated,"  and  recalculate  Reserve  Component  (RC) 
costs  upon  activation. 

HAF/A1 

56  Clarify  missions  that  the  Guard  and  Reserve  are 
currently  performing  by  providing  categories  of 
cyber  work,  including  combat  communications, 
for  each  RC  unit. 

AF/RE,  AFRC/A1,  ANGRC, 
25th  AF/A1 

57  Discontinue  the  use  of  the  term  computer  network  HAF/A1 ,  AF/RE,  ANGRC 
attack  (as  well  as  any  other  terms  associated  with 
offensive  cyber  missions)  to  describe  a  cyber 
mission.  Explicitly  define  those  missions  within 
cyber  (computer  network  defense,  etc.)  that  can 
be  performed  by  Guard  and  Reserve  personnel. 

In  particular,  clearly  define  what  functions  Guard 
personnel  can  perform  in  Title  32  or  state  active 
duty  (SAD)  status. 


APPENDIX  205 


Recommendations:  The  Air  National  Guard,  the  Air  Force 
Reserve,  and  Cyber  (Chap.  6)  ( continued ) 

Recommendation 

Implementation/Status 

58  Collocate  CPTs  at  each  Federal  Emergency  Man¬ 
agement  Agency  (FEMA)  regional  headquarters — 
all  located  in  highly  populated  urban  areas — to 
aid  in  recruiting  a  trained  cyber  workforce  and 
help  mitigate  sourcing  problems. 

HAF/A1 ,  AF/RE,  ANGRC 

59  Increase  training  funds  to  assure  cyber  reservist 
currency. 

HAF 

60  The  National  Security  Agency  (NSA)  and  US-  NSA,  USCYBERCOM 
CYBERCOM  should  clearly  articulate  in  formal 

planning  documents  the  Guard  and  Reserve 
cyber  missions.  In  the  interim,  designate  pro¬ 
jected  CPTs  as  Guard  units  (per  the  Council  of 
Governors)  for  each  FEMA  region.  Otherwise, 
halt  further  expansion  until  formal  planning  is 
accomplished. 

61  The  DHS  should  fund  the  Guard's  cyber  acces-  SAF/FMB 
sions  in  support  of  the  DHS.  Use  the  Office  of 

National  Drug  Control  Policy  (ONDCP)  counter¬ 
drug  funding  example  as  a  guide. 

62  Recruiting  for  cyber  units  should  not  focus  AFRC,  ANGRC 

exclusively  on  employees  from  the  computer  / 

cyber  security  industry.  They  may  have  the  proper 
background,  but  conflicts  of  interest  could  inhibit 
their  full  utilization  in  an  emergency. 

Recommendations:  Educating  and  Training 
Cyber  Forces  (Chap.  7) 

Recommendation  Implementation/Status 

63  To  overcome  the  problem  of  obsolete  standards,  In  Progress:  HAF/A6SP, 
reform  the  ISD  process  to  ensure  timely  cyber  AETC 

career  field  training  attuned  to  the  operational 
environment.  Along  these  lines,  HAF/A6SP  is 
reviewing  the  requirements  document  govern¬ 
ing  the  UCT  curriculum.  To  keep  pace  with  the 
rapidly  evolving  cyber  domain,  the  subsequent 
requirements  document  will  be  less  restrictive 
with  its  specifications,  thus  allowing  courses  to 
maintain  operational  currency  between  triennial 
reviews. 

64  Since  the  cyberspace  domain  is  so  pervasive  In  Progress:  HAF/A6SP 

and  joint  in  nature,  map  training  to  the  NICE 

cybersecurity  workforce  framework  for  KSAs  or 
NICE  KSAs.  This  standard  is  a  reasonably  good 
one,  appropriate  not  only  for  the  Air  Force  but 
also  for  the  other  military  services  and  govern¬ 
ment  agencies. 
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Recommendations:  Educating  and  Training 
Cyber  Forces  (Chap.  7)  ( continued ) 


Recommendation 

Implementation/Status 

65 

HAF  A2/A3/A6  should  examine  the  possibility 
of  a  single  cyberspace  transition  course  or  work 
with  USCYBERCOM  and  the  joint  community  to 
create  a  replacement  training  unit  (RTU)  or  transi¬ 
tion  course. 

HAF/A1/A6,  24th  AF 

66 

Investigate  schoolhouse  manning  to  find  ways 
to  maintain  adequate  levels  of  instructors  while 
allowing  proper  instructor  continuing  education 
and  career  progression. 

AFSPC,  AETC/A1 

67 

The  USAF  must  find  ways  to  make  cyber  training 
and  education  adaptive  to  the  developments  in 
the  field. 

SAF/FM,  AFSPC,  AETC, 

24th  AF 

68 

The  best  way  to  increase  interest  in  the  1 7-series 
AFSC  is  for  USAFA  customers  to  tell,  and  then 
prove  to,  cadets  that  the  Air  Force  has  good  jobs 
for  them.  Knowing  there  are  interesting  jobs  in 
the  field  will  drive  up  interest. 

USAFA,  24th  AF,  NSA 

69 

Creating  a  summer  course  for  cadets  would  be 
useful  as  a  means  of  enticing  them  into  the  career 
field.  Currently,  one  does  not  exist  (it  was  elimi¬ 
nated  when  the  1 1 0  course  was  updated  and 
offered  to  all  cadets  in  their  first  year). 

USAFA 

70 

Maintain  steady  ROTC  budgets  to  hedge  against 
the  risk  of  OTS  not  producing  adequate  quality/ 
quantity  of  1  7D  accessions  when  the  economy 
picks  up. 

AETC/AU 

71 

The  USAF  should  take  a  more  focused  look  at 
how  the  two  Cyber  ACE  programs  can  be  better 
leveraged  to  help  meet  USAF  cyber  needs. 

AU/CC 

72 

To  continue  the  trend  of  developing  highly 
capable  cyber  operators,  fully  fund  and  expand 
the  AFIT/AFRL  distinct  ACE  programs.  Fully  fund, 
in  POM,  the  AFRL/RI  ACE  program.  Fully  fund,  in 
POM,  the  AFIT  ACE  program  for  ROTC. 

SAF/FM 

73 

Mandate  an  AFIT  name  change  to  avoid  confu¬ 
sion  with  the  distinct  AFRL/RI  program.  Re-recog- 
nize  AFRL/RI  ACE  as  a  national  asset  and  a  CSAF 
special-interest  item. 

AU/CC 

Abbreviations 


AAD 

advanced  academic  degree 

ABET 

Accreditation  Board  for  Engineering 
and  Technology 

AC 

active  component 

ACC 

Air  Combat  Command 

ACE 

Advanced  Course  in  Engineering 

ACSC 

Air  Command  and  Staff  College 

ACTFL 

American  Council  on  the  Teaching  of 
Foreign  Fanguages 

ADSC 

active  duty  service  commitment 

AETC 

Air  Education  and  Training  Command 

AFA 

Air  Force  Association 

AFCYBER 

Air  Forces  Cyber 

AFDD 

Air  Force  doctrine  document 

AFERB 

Air  Force  Education  Requirements  Board 

AFISRA 

Air  Force  Intelligence,  Surveillance,  and 
Reconnaissance  Agency 

AFIT 

Air  Force  Institute  of  Technology 

AFIT/EN 

Air  Force  Institute  of  Technology/ Graduate 
School  of  Engineering  and  Management 

AFNIC 

Air  Force  Networking  Integration  Center 

AFOQT 

Air  Force  Officer  Qualifying  Test 

AFPC 

Air  Force  Personnel  Center 

AFR 

Air  Force  Reserve 

AFRC 

Air  Force  Reserve  Command 

AFRI 

Air  Force  Research  Institute 

AFRF 

Air  Force  Research  Faboratory 

AFRF/RI 

Air  Force  Research  Fab  oratory/ Information 
Directorate 

AFSC 

Air  Force  specialty  code 

AFSPC 

Air  Force  Space  Command 
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AGR 

Active  Guard  and  Reserve 

altDNS 

alternative  domain  name  system 

ANG 

Air  National  Guard 

ASVAB 

Armed  Services  Vocational  Aptitude  Battery 

AU 

Air  University 

AWC 

Air  War  College 

BCS 

building  control  system 

BMT 

Basic  Military  Training 

C-ACTS 

Consortium  for  Advanced  Cyber  Thinking 
and  Strategy 

CAG 

Cyber  Advisory  Group 

CCAF 

Community  College  of  the  Air  Force 

CDC 

career  development  course 

CE 

computer  engineering 

CFETP 

career  field  education  and  training  plan 

CIFTU 

Cyber  Intelligence  Follow-on  Training  Unit 
(course) 

CIO 

chief  information  officer 

CIPP 

Career  Intermission  Pilot  Program 

CLEP 

College  Level  Examination  Program 

CMF 

Cyber  Mission  Force 

CMSgt 

chief  master  sergeant 

CMT 

cyber  mission  team 

CNCI 

Comprehensive  National  Cybersecurity 
Initiative 

CNODP 

Computer  Network  Operations  Development 
Program 

CNS 

computer  and  network  security 

COEC 

Cyberspace  Operations  Executive  Course 

COS 

civilian  occupational  specialty 

CPT 

cyber  protection  team 

CS 

computer  science 

CSAF 

chief  of  staff  of  the  Air  Force 
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CST 

combat  mission  direct  support  team 

DAF 

Department  of  the  Air  Force 

DARPA 

Defense  Advanced  Research  Projects  Agency 

DCO 

defensive  cyberspace  operations 

DHS 

Department  of  Homeland  Security 

DISA 

Defense  Information  Systems  Agency 

DLPT 

Defense  Language  Proficiency  Test 

DNS 

Domain  Name  System 

DOD 

Department  of  Defense 

DODIN 

Department  of  Defense  Information  Network 

DODNIC 

Department  of  Defense  Network 

Integration  Center 

DSCA 

Defense  Support  to  Civil  Authorities 

ECSS 

Expeditionary  Combat  Support  System 

EE 

electrical  engineering 

EW 

electronic  warfare 

FAPSI 

Federal  Agency  for  Government 
Communications  and  Information  (Russia) 

FedVTE 

Federal  Virtual  Training  Environment 

FEMA 

Federal  Emergency  Management  Agency 

FLPP 

foreign  language  proficiency  pay 

FM 

Financial  Management 

FTP 

file  transfer  protocol 

FTU 

follow-on  training  unit 

FY 

fiscal  year 

gTLD 

generic  top-level  domain  name 

HAF 

Headquarters  Air  Force 

HAF/A1 

Headquarters  Air  Force/Deputy  Chief  of 

Staff  for  Personnel 

HAF/A2 

Headquarters  Air  Force/ Intelligence 

HQ 

headquarters 

HTTP 

hypertext  transfer  protocol 
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IADS 

integrated  air  defense  system 

ICANN 

Internet  Corporation  for  Assigned  Names 
and  Numbers 

ICS 

industrial  control  system 

IDA 

Institute  for  Defense  Analyses 

IDE 

intermediate  developmental  education 

IDS 

intrusion  detection  system 

IMA 

individual  mobilization  augmentee 

INWT 

Intermediate  Network  Warfare  Training 

IO 

information  operations 

IOFAC 

Information  Operations  Fundamentals 
Application  Course 

IOS 

information  operations  squadron 

iOS 

iPhone  Operating  System 

IP 

Internet  Protocol 

IPTV 

Internet  Protocol  television 

IPv4 

Internet  Protocol  version  4 

IPv6 

Internet  Protocol  version  6 

IQT 

initial  qualification  training 

ISD 

Instructional  Systems  Development 

ISR 

intelligence,  surveillance,  and  reconnaissance 

IT 

information  technology 

ITU 

International  Telecommunication  Union 

IW 

intelligence  wing 

JAG 

judge  advocate  general 

JCAC 

Joint  Cyber  Analysis  Course 

JIE 

Joint  Information  Environment 

JP 

joint  publication 

KSA 

knowledge,  skill,  and  ability 

LAN 

local  area  network 

LTE 

long-term  evolution 

MAJCOM 

major  command 
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MECC 

Military  Education  Coordination  Council 

NAF 

numbered  Air  Force 

NCO 

noncommissioned  officer 

NCOIC 

noncommissioned  officer  in  charge 

NCSAF 

National  Commission  on  the  Structure  of 
the  Air  Force 

NDAA 

National  Defense  Authorization  Act 

NICE 

National  Initiative  for  Cybersecurity 
Education 

NIST 

National  Institute  of  Standards  and 
Technology 

NMT 

national  mission  team 

NSA 

National  Security  Agency 

NSSI 

National  Security  Space  Institute 

oco 

offensive  cyberspace  operations 

OCR 

office  of  collateral  responsibility 

OJT 

on-the-job  training 

OMB 

Office  of  Management  and  Budget 

ONDCP 

Office  of  National  Drug  Control  Policy 

OPM 

Office  of  Personnel  Management 

OPR 

office  of  primary  responsibility 

OT 

operational  technology 

OTS 

Officer  Training  School 

PCE 

professional  continuing  education 

PLC 

programmable  logic  controller 

PM 

program  management 

PME 

professional  military  education 

POM 

program  objective  memorandum 

POTS 

plain  old  telephone  system 

R&D 

research  and  development 

RAM 

random  access  memory 

RC 

Reserve  Component 
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RFPB 

Reserve  Forces  Policy  Board 

RNET 

reserve  network 

ROTC 

Reserve  Officer  Training  Corps 

RTU 

replacement  training  unit 

SAASS 

School  of  Advanced  Air  and  Space  Studies 

SAD 

state  active  duty 

SAF/CIO/A3C/ 

Air  Force  Secretariat/ Cyberspace  Ops  and 

A6C 

Warfighting  Integration  Directorate 

SAF/CIO/A6 

Air  Force  Secretariat/ Office  of  Information 
Dominance  and  Chief  Information  Officer 

SAF/CIO/A6S 

Air  Force  Secretariat/ Cyberspace  Strategy  and 
Policy  Directorate 

SCADA 

supervisory  control  and  data  acquisition 

SCI 

sensitive  compartmented  information 

SE 

systems  engineering 

SEC 

US  Securities  and  Exchange  Commission 

SECAF 

secretary  of  the  Air  Force 

SEI 

special  experience  identifier 

SFITS 

Federal  Information  and  Telecommunications 
System  (Russia) 

SIGINT 

signals  intelligence 

SJIOAC 

Senior  Joint  Information  Operations 
Applications  Course 

SMART 

Science,  Mathematics,  and  Research  for 
Transformation 

SME 

subject  matter  expert 

SMS 

short  message  service 

SMSgt 

senior  master  sergeant 

STEAM 

science,  technology,  engineering,  arts,  and 
mathematics 

STEM 

science,  technology,  engineering,  and 
mathematics 

TCP 

transmission -control  protocol 
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TDY 

temporary  duty 

TOR 

The  Onion  Router 

TS 

Top  Secret 

HP 

tactics,  techniques,  and  procedures 

TW 

training  wing 

UCT 

Undergraduate  Cyber  Training 

USAFA 

United  States  Air  Force  Academy 

USCYBERCOM 

United  States  Cyber  Command 

WO 

warrant  officer 

WWW 

World  Wide  Web 
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In  response  to  a  tasking  from  the  Air  Force  chief  of 
staff,  the  Air  Force  Research  Institute  (AFRI)  con¬ 
ducted  a  review  of  USAF  cyber  force  training  and 
development.  The  resulting  findings  were  used  to 
develop  recommendations  for  how  the  Air  Force 
should  recruit,  educate,  train,  and  develop  cyber 
operators  from  the  time  they  are  potential  acces¬ 
sions  until  they  become  senior  leaders  in  the 
enlisted  and  officer  corps.  This  study’s  discoveries, 
analyses,  and  recommendations  are  aimed  at 
guiding  staff  officers  and  senior  leaders  alike  as  they 
consider  how  to  create  a  cyber  workforce  that  better 
supports  both  Air  Force  and  US  Cyber  Command 
missions  across  the  range  of  military  operations. 
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